Implications and remedies of fixed 'H' in Pedersen commitment

Question

In the monero document "Zero to Monero" pp. 30 the Pedersen Commitment scheme is described as requiring generators G, H such that no-one knows an x where G = x*H. The actual H is defined as H=to_point(Keccak(G)) where to_point is a function mapping scalars to elliptic curve points. Gregory Maxwell describes this function in more detail:

... Where to_point() takes the input as the x value of a new point, checks that its on the curve and solves for the y value. ...

Rather than simply multiplying by G, somewhat breaking the scheme.

However, if someone was to figure out the x above doesen't this become a single, centralized point-of-failure for the entire currency? Meaning that by breaking this single, 128-bit secure key, absolutely all monero transactions - future and past - could be decoded w.r.t. the amounts sent? As a follow up: would it be possible for the sender to pick a fresh H for every transaction?

Answer 1

The commitment is actually xG + aH where both G and H are pre-defined generators. The hardness of the discrete logarithm problem ensures calculating a from H (or x from G) is infeasible. Put another way, both G and H are points, and because of ECC point multiplication, you can't deduce x or a.

Further, you'll see described in Maxwell's Confidential Transactions paper:

The Pedersen commitment is created by picking an additional generator
for the group (which we'll call H) such that no one knows the discrete
log for H with respect to G (or vice versa), meaning no one knows an
x such that xG = H. We can accomplish this by using the cryptographic
hash of G to pick H:

    H = to_point(SHA256(ENCODE(G)))

Which is precisely how H is constructed in Monero: H = Hp(G), which is H = to_point(Keccak(G)).

Further:

However, if someone was to figure out the x above doesen't this become a single, centralized point-of-failure for the entire currency?

No. x is a binding factor in a single commitment. A centralized point of failure would be if someone knew the discrete log for H with respect to G (or vice versa). If one miraculously calculated an x in one commitment, this wouldn't compromise other commitments. Think about it like this: just because you know your x for a commitment, doesn't mean you can work out other x's.

Also:

As a follow up: would it be possible for the sender to pick a fresh H for every transaction?

That's essentially what happens because of the point multiplication using a. E.g. aH.