ALT Math challenge 2 (Pedersen commitments): Be the quantum computer. A commitment is C = v·H + r·G, and nobody knows h with H = h·G. A quantum computer would find it. What it means: old amounts stay hidden in the commitments. But whoever knows h can mint coins that pass every check, range proofs included: an inflation attack. Puzzle: find h, then mint. The curve is y² = x³ + 7 mod p = 2⁶¹ − 1 (it has 43·q points). G and H have prime order q = 53624256071278747. Alice's coin C is worth 1. G = (1217468943615328232, 2065245357365722203). H = (121249104770771710, 552385845561251560). C = 1·H + r·G with r = 1234567890123456. Attack: turn C into two coins worth more than 1 in total. Find C₁ = v₁·H + r₁·G and C₂ = v₂·H + r₂·G with C₁ + C₂ = C and 1 ≤ v₁, v₂ < 1000. Reply with v₁, r₁, v₂, r₂. @msbrogli

ALT Solution 1, Pedersen Commitments. Step 1: C₁ = C₂ means (r₂ − r₁)·G = v₁·H₁ − v₂·H₂. Step 2: G generates the group, so H₁ = k₁·G and H₂ = k₂·G for some k₁, k₂; the proof only needs them to exist. G has prime order q, so C₁ = C₂ exactly when r₂ − r₁ ≡ v₁k₁ − v₂k₂ (mod q). Step 3: let X = r₂ − r₁ and t = v₁k₁ − v₂k₂. X is uniform mod q: r₂ is uniform and independent of r₁, so for each r₁ every value of X comes from exactly one r₂. The number t is fixed: it depends only on the amounts and tokens, not on r₁, r₂. Result: P(C₁ = C₂) = P(X = t) = 1/q, for any amounts and tokens. What it means: unlike a plain hash of the amount, equal amounts do not give equal commitments. Two payments of 40 USDT collide with probability only 1/q, about 2⁻²⁵⁶ on secp256k1. This alone does not prove that a commitment reveals nothing about its amount. That takes a stronger result: perfect hiding. Sources: Pedersen 1991; Confidential Assets, 2017. @msbrogli