Bitcoin contributor Pieter Wuille recently commented on Reddit:

Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that if they're adopted inside Bitcoin, and elliptic curve crypto is (completely) broken, new money can be printed. On the flip side, it does mean that the privacy of anyone who used CT in the past is unaffected. Alternative formulations of CT exist for which this is the other way around (perfectly binding but not perfectly hiding), where money can never be printed (even if the cryptography is broken), but privacy can be retroactively lost. There is currently a discussion on the mailinglist which of these is the better tradeoff (it is mathematically impossible to have both perfect hiding and binding).

Which design did Monero choose to use?

1 Answer 1


Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though).

As to what should be chosen, think about this:

We can always replace lost money, but we can't ever replace lost privacy.

  • just for clarification blinding == hiding, not binding right?
    – scoob
    Nov 17, 2017 at 21:20
  • 1
    yup; edited to hiding
    – JollyMort
    Nov 17, 2017 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.