# Pedersen Commitment

## Abstract
The `Pedersen Commitment` is the technology which allows us to check the transfer amount is valid without revealing actual amount.

## Details
This technology uses additivity of elliptic curve. Hiding the transfer amount as scalar of elliptic curve point and mixing random value refer as to `blinding factor`. Let's take a look the squence.

1. Setup the parameters
2. Hide the transfer amount
3. Verify the transfer amount

Above sequence used for confidential transfer to keep the transfer amount secret.

## Setup The Parameters
First of all, we'd like to setup the parameters we are going to use with the `Pedersen Commitment`. Selecting generator `G` over prime order elliptic curve group and randomness `a` less than order prime. Calculating `H = aG` and making `H` and `G` public. We can't predict the `a` value from `H` and `G` because of discrete logarithm.

Variable | Explanation | Derivation
:------------ | :------------- | :-------------
p | prime number | -
a | random number | a ∈ Fp
C(x) | elliptic curve function | -
G | generator of elliptic curve point | G ∈ C(Fp)
H | generator made by random a | H = aG

## Hide The Transfer Amount
Let's assume that Alice has `10` balance and send Bob to `3`. We need to check `{Alice balance} - {transfer amount} = {Alice after balance}` without revealing any information about Alice balance. Alice knows `H`, `G` and her balance so she computes following value.

- Alice balance commitment
$$ C(10) = 10H + x_1G $$
- Transfer amount commitment
$$ C(3) = 3H + x_2G $$
- Alice after balance commitment
$$ C(10 - 3) = 7H + x_3G $$

In above equation, `x_1 ~ x_3` are called `blinding factor` and each blinding factor need to be set to hold `{Alice balance} - {transfer amount} = {Alice after balance}` equation. Let's say `x_1 = 330`, `x_2 = 30` and `x_3 = 300`.

## Verify The Transfer Amount
In previous section, Alice computes the following commitment.

$$ C(10, 330) = 10H + 330G $$
$$ C(3, 30) = 3H + 30G $$
$$ C(10 - 3, 300) = 7H + 300G $$

Let's check if Alice transfer amount is valid. The elliptic curve arithmetic supports additive so we can check `{Alice balance} - {transfer amount} = {Alice after balance}` as following.

$$ C(10, 330) - C(3, 30) - C(10 - 3, 300) = C(10 - 3 - 7, 330 - 30 - 300) = 0H + 0G = 0 $$

If above equation holds up, we can know the transfer amount is valid. Through this process, `balance` and `transfer amount` are encrypted by elliptic curve so no one can predict actual value from public information. This is how we conceal the transfer transaction and verify the validity.