In the monero document "Zero to Monero" pp. 30 the Pedersen Commitment scheme is described as requiring generators
G, H such that no-one knows an
G = x*H. The actual
H is defined as
to_point is a function mapping scalars to elliptic curve points. Gregory Maxwell describes this function in more detail:
... Where to_point() takes the input as the x value of a new point, checks that its on the curve and solves for the y value. ...
Rather than simply multiplying by
G, somewhat breaking the scheme.
However, if someone was to figure out the
x above doesen't this become a single, centralized point-of-failure for the entire currency? Meaning that by breaking this single, 128-bit secure key, absolutely all monero transactions - future and past - could be decoded w.r.t. the amounts sent? As a follow up: would it be possible for the sender to pick a fresh
H for every transaction?