# 8.4 Pedersen Confidential Payments

Pedersen commitments are used to prove ledger correctness without revealing transaction amounts. Their security relies on the hardness of the discrete logarithm problem.

## Core Definitions

* Public parameters: cyclic group, generators `G` and `H`
* Commitment formula: `C = v * G + r * H`
* `v`: committed amount
* `r`: blinding factor (random value)

The hiding property comes from the random blinding factor `r`; the binding property comes from the hardness of discrete logarithms.

## Verification Method

After the committer discloses `(v, r)`, the verifier computes:

`v * G + r * H ?= C`

If they are equal, the commitment is valid.

## Role in Confidential Payments

* Amount hiding: only commitment `C` is published on-chain, not plaintext amount `v`
* Conservation check: homomorphic properties are used to verify input/output balance

Homomorphic relationship:

`Commit(v1, r1) + Commit(v2, r2) = Commit(v1 + v2, r1 + r2)`

The balance check can be written as:

`(C_in1 + C_in2 + ...) - (C_out1 + C_out2 + ...) = Commit(0, r)`

This allows the network to verify "no hidden minting" without revealing exact values.

## Original Code Snippet (Minimally Cleaned)

> Note: The original docx version had broken line wraps and indentation; the main structure is preserved below for manual revision.

```python
# H generation
H = point_hash("Pedersen Generator")

def point_hash(s):
    h = hashlib.sha256(s.encode()).hexdigest()
    x = int(h, 16) % P
    return (x, (x**3 + 7) % P)

def mod_inv(a, n):
    return pow(a, n - 2, n)

def point_add(p1, p2):
    # Elliptic-curve point addition (simplified from the source text)
    ...

def point_mul(p, n):
    # Elliptic-curve scalar multiplication (the source text may contain an n >= 1 typo)
    ...

class PedersenCommitment:
    def __init__(self):
        self.G = G
        self.H = H

    def commit(self, value, blind=None):
        # C = value * G + blind * H
        ...

    def verify(self, value, blind, commitment):
        ...
```

## Items Pending Manual Confirmation

* A Paillier-related fragment appears near the end of the original source and may have been mixed into this section by mistake.
* Some code lines were merged in the docx and should be verified against the original technical manuscript.
* For a publishable technical-whitepaper version, add runnable examples and test vectors.