El Gamal commitments, for example, are perfectly binding but only computationally hiding.

That's very interesting. I stand corrected in that respect. Thanks for the information Adam!

On Fri, Feb 25, 2022, 05:17 AdamISZ <AdamISZ@protonmail.com> wrote:
> I really don't see a world where bitcoin goes that route. Hiding coin amounts would make it impossible to audit the blockchain and verify that there hasn't been inflation and the emission schedule is on schedule. It would inherently remove unconditional soundness from bitcoin and replace it with computational soundness. Even if bitcoin did adopt it, it would keep backwards compatibility with old style addresses which could continue to use ordinals.

Nit: it isn't technically correct to say that amount hiding "inherently removes unconditional soundness". Such commitments can be either perfectly hiding or perfectly binding; it isn't even logically possible for them to be both, sadly. But we are not forced to choose perfect binding; El Gamal commitments, for example, are perfectly binding but only computationally hiding.