confidential transaction Archives

Download pdf here: CT and Pedersen Commitment

1. Introduction

Pedersen Commitments are at the heart of how Monero conceals transaction amounts. The notion of a confidential transaction as enabled by Pedersen Commitments were outlined and defined by Gregory Maxwell in [1]. In what follows we first introduce the notion of a group homomorphism (of which the Pedersen Commitment map is a particular instance), we then define the Pedersen Commitment map, and finally present the mechanisms of a confidential transaction enabled by a such a map.

2. Group homomorphism

Let $(M, \boxplus)$ and $(N, \oplus)$ be 2 groups with respective group operations $\boxplus$ and $\oplus$ . A function $f: M \rightarrow N$ is called a group homomorphism if and only if

$f(u \boxplus v) = f(u) \oplus f(v),\ \forall u, v \in M$

In other terms, operating on 2 elements in $M$ and then applying $f$ is equivalent to applying $f$ on each element separately and then operating on the 2 outputs in $N$ .

We now introduce a specific instance of a group homomorphism that we will invoke when concealing transaction amounts with Monero as part of the confidential transaction construct. In particular, we conduct arithmetic in the subgroup $\{{G\}}$ of the elliptic curve group $E.$ introduced in part 5 (refer to the post entitled Elliptic Curve Groups for an introduction to this topic)

Let $(N, \oplus) \equiv (\{{G\}}, \oplus)$ , and let $(M, \boxplus) \equiv (\mathbb{F}_l \times \mathbb{F}_l, +)$ where $+$ denotes element-wise addition in modulo $l$ arithmetic over $\mathbb{F}_l \times \mathbb{F}_l.$

It is a known result in group theory that if $a$ is a generator of a cyclic group $\{{a\}}$ of order $m$ , then there are $\phi(m)$ elements of the group that have order $m$ ( $\phi$ is the euler function introduced in part 1). In our case, the generator $G$ of $\{{G\}}$ has prime order $l$ . Moreover $\phi(l) = l-1$ (since $l$ is prime). Hence we can find $l-1$ other generators of $\{{G\}}$ . Let $H \neq G$ be another generator such that the DL (discrete logarithm) of $H$ with respect to $G$ is unknown. We define the Pedersen Commitment map (which we will later use to build a confidential transaction) as follows: