Hash as encryption used by Monero

Question

Monero uses a Pedersen commitment yG + bH to obfuscate the value of a transaction, where b is the value and y is the blinding factor.

For the receiver to know both variables, it uses a Diffie-Hellman key exchange to share a secret rK, where r is a randomness chosen by the sender and K is a public key of the receiver. R = rG is public and sent as part of the transaction. The sender computes the following (the $amount$ is also sent in the transaction and H is a hash function):

y = H(“commitment mask”, H(rK))
amount = b xor H("amount", H(rK))

The receiver is able to compute y and b using R and his private key k.

Source: Zero-to-Monero, page 45

My questions are: can this be considered an encryption/decryption scheme and is it already known or is it original to Monero? If the latter, how can we prove its security?

Answer 1

My questions are: can this be considered an encryption/decryption scheme and is it already known or is it original to Monero?

Pedersen commitments (which are a commitment scheme not "an encryption/decryption scheme"), have been around since the early nineties. The encryption bit of what you refer to is simply the XOR of the amount and a key, the latter of which is a hash of a piece of data only the sender or receiver can construct (as it makes use of the shared secret). Using XOR to encrypt data is extremely common and certainly predates even Pedersen commitments.

What's original to Monero is how these elements (and others) are brought together and what they are applied to (i.e. a cryptocurrency, private digital cash). The security properties of all these elements is already well researched and understood.