4

Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H which are group elements. I am not sure who generates it? Is trusted setup assumed?

254123179
  • 4,586
  • 4
  • 32
  • 58
user2582387
  • 41
  • 1

1 Answers1

3

G is a universally agreed-upon base point. Almost everyone that uses ed25519, including Monero, uses the same G.

H is an agreed-upon base point within Monero's implementation of the Pedersen commitment scheme. It is chosen arbitrarily such that it is impossible to know the discrete log with respect to G (i.e. there is some x such that xG == H, but x will never be known).

The security of Pedersen commitments relies on x being unknowable.

Bottom line: All Monero wallets and daemons use the same values of G and H.

knaccc
  • 8,518
  • 17
  • 23