In the monero document "Zero to Monero" pp. 30 the Pedersen Commitment scheme is described as requiring generators G, H
such that no-one knows an x
where G = x*H
. The actual H
is defined as H=to_point(Keccak(G))
where to_point
is a function mapping scalars to elliptic curve points. Gregory Maxwell describes this function in more detail:
... Where to_point() takes the input as the x value of a new point, checks that its on the curve and solves for the y value. ...
Rather than simply multiplying by G
, somewhat breaking the scheme.
However, if someone was to figure out the x
above doesen't this become a single, centralized point-of-failure for the entire currency? Meaning that by breaking this single, 128-bit secure key, absolutely all monero transactions - future and past - could be decoded w.r.t. the amounts sent? As a follow up: would it be possible for the sender to pick a fresh H
for every transaction?