Are Confidential Transactions in Monero perfectly binding or hiding?

Question

Bitcoin contributor Pieter Wuille recently commented on Reddit:

Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that if they're adopted inside Bitcoin, and elliptic curve crypto is (completely) broken, new money can be printed. On the flip side, it does mean that the privacy of anyone who used CT in the past is unaffected. Alternative formulations of CT exist for which this is the other way around (perfectly binding but not perfectly hiding), where money can never be printed (even if the cryptography is broken), but privacy can be retroactively lost. There is currently a discussion on the mailinglist which of these is the better tradeoff (it is mathematically impossible to have both perfect hiding and binding).

Which design did Monero choose to use?

Answer 1

Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though).

As to what should be chosen, think about this:

We can always replace lost money, but we can't ever replace lost privacy.