Pedersen commitment

A Pedersen commitment takes the form C = g^m · h^r, where g and h are generators of a prime-order group, m is the committed value and r a random blinding factor. It is perfectly hiding, since C reveals nothing about m with information-theoretic security, and computationally binding under the discrete logarithm assumption. The scheme comes from Torben Pryds Pedersen's work presented at CRYPTO 1991.

Its central property is that it is additively homomorphic: the product of two commitments equals the commitment to the sum of the values. This lets you add and subtract committed amounts without opening them, the basis of confidential transactions, where you verify that inputs equal outputs without seeing any figure. It helps to distinguish it from KZG: Pedersen commits to a scalar or vector, is homomorphic and needs no trusted setup; KZG commits to a polynomial, gives constant-size evaluation proofs and does require one. They are primitives with different purposes.

Among real uses, Bitcoin's Confidential Transactions designed by Greg Maxwell and Blockstream's Liquid Network sidechain employ Pedersen commitments to hide amounts. Monero uses them in RingCT to conceal each transaction's values, and Zcash incorporates Pedersen-based commitments within its Sapling circuit. For a business designing assets with balance privacy, it is the piece that lets you prove correct accounting without publishing individual figures.