Monero uses a Pedersen commitment yG + bH
to obfuscate the value of a transaction, where b
is the value and y
is the blinding factor.
For the receiver to know both variables, it uses a Diffie-Hellman key exchange to share a secret rK
, where r
is a randomness chosen by the sender and K
is a public key of the receiver. R = rG
is public and sent as part of the transaction. The sender computes the following (the $amount$ is also sent in the transaction and H
is a hash function):
y = H(“commitment mask”, H(rK))
amount = b xor H("amount", H(rK))
The receiver is able to compute y
and b
using R
and his private key k
.
Source: Zero-to-Monero, page 45
My questions are: can this be considered an encryption/decryption scheme and is it already known or is it original to Monero? If the latter, how can we prove its security?