Pedersen Commitment Implementation

[bctax]

Hello, I m still curious on how to get pedersen commitments working as they might provide homomorphic operations.

My understanding is that their implementation should be relatively simple: Given the base point G and another point H, a message m and a blinding r, we just have to compute Comm(m,r)=m*G+r*H

However, what is not quite intuitive to me is: How to choose G and H. Can we use for G the generator of the jubjub curve? How to choose H?

field Gu = 16540640123574156134436876038791482806971768689494387082833631921987005038935
field Gv = 20819045374670962167435360035096875258406992893633759881276124905556507972311

[kunxian-xia]

G and H are generated by iterate over x coordinate and check if there is a valid y-coordinate.

[bctax]

However, G and H are public parameters for the commitment scheme right? Must both fullfill another criteria other than lying on the curve?

[stefandeml]

Yes, G and H are setup parameters for the commitment scheme and public.

They must be on the curve and in the right subgroup. Furthermore, there must not be any link between G and H as this would introduce a trapdoor. You can use this function to sample new generator points: https://github.com/Zokrates/pycrypto/blob/master/zokrates_pycrypto/babyjubjub.py#L135