What is the significance of monero switching the G and H points in a Pedersen commitment?

Question

Conventionally G is used to denote the standard Generator.

H is then some point whereby the discrete log is not known with respects to G; H = yG where y is unknown.

A pedersen commitment would normally then be P = aG + bH. Where b is blinder and a is the value you wish to commit to.

In monero, we have P = bG + aH.

How would the mathematics break if I used the first definition? My initial guess is that it would not, unless maybe there are places in the code where this role is switched again.

That leads me onto my next question; Are there places in the code where the role of G and H are switched?

Follow-up to this, page35 on zero to monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf

Describes the process of going from the private spend key to public spend key: publicSpend = privateSpend * G is the G used here, different from the G used in the Pedersen commitment?

TBC:

• If the numbers were switched, we would also switch the maths to match it, for example the commitment to zero would become zH
• Assume that x and y are both unknown for H = yG and H = xH

Answer 1

A pedersen commitment would normally then be P = aG + bH. Where b is blinder and a is the value you wish to commit to.

You again have these the wrong way round. The blinding factor goes next to the G and the amount next to the H.

How would the mathematics break if I used the first definition?

If you swapped the generators in the commitments, every other piece of code that touched/used a commitment would also need to change. This is obvious becausexG != xH.

In theory one could swap them round in the commitments, but then a ton of other code would need changing to factor this in. A change for no gain. Convention, usage and documentation has them positioned the way they are.

Are there places in the code where the role of G and H are switched?

No. To my knowledge,H is only ever used in the Pedersen commitments.

I find this an odd line of questioning in any case. What possible reason would one have to swap the generators? The Confidential Transactions (the Pedersen commitments), are the only place that requires an extra (different) generator.

The generator G is used in multiple places throughout the code base, not just in the Pedersen commitments for the blinding factors.

Lastly,

is the G used here, different from the G used in the Pedersen commitment?

No. G is G. It's the curve generator used throughout. If there is ever another different generator needed (as in the case of the Pedersen commitments H), it is of course labeled differently to avoid ambiguity / confusion.