Pedersen commitment

A Pedersen commitment hides a value inside a single elliptic-curve point, while letting you do arithmetic on the hidden values — add two commitments and you get a commitment to the sum. That additive homomorphism is the cryptographic heart of confidential transactions.

Pick two independent generators G and H on an elliptic curve, chosen so that nobody knows the discrete-log relation between them. To commit to a value v with random blinding factor r, compute C = v·H + r·G. The scheme is perfectly hiding — for any v there exists an r making C equal any point, so C leaks nothing even to a computationally unbounded adversary — and computationally binding, since opening C to a different v' would require solving the discrete log of H with respect to G.

Homomorphism is the superpower: C(v1, r1) + C(v2, r2) = C(v1 + v2, r1 + r2). In confidential transactions (Monero, Mimblewimble, Liquid), this proves that inputs minus outputs sum to zero — no coins were created — without revealing any individual amount: a verifier just checks the input and output commitments balance to a commitment of zero. Pair it with a range proof (such as Bulletproofs) to rule out negative-value cheats, and you get full amount privacy. Pedersen vector commitments also appear inside several zero-knowledge proof systems.