Pedersen commitment in elliptic curves I try to understand Pedersen commitment in elliptic curves over finite fields. I could use some clarification. 

Let's say we have two generators $G$ and $H$.


Is that required that $G$ and $H$ are two different generators of the same group?


Pedersen Commitment $C$ will look like that.

$$C = aG + bH$$


$C$ is a point on the curve, right?


Now in the situation when $a=0$ we have

$$C = 0G + bH = bH$$


How do I know that $bH$ is generated by $H$ without revealing $b$?
How do I know that $bH$ is not generated by $G$?
Is that required that $G$ and $H$ are two different generators of the same group?
  


Yes. Pedersen commitment uses random public generators $G$ and $H$ of a suitable large group where the Discrete Logarithm is hard, thus $G$ and $H$ can safely be assumed distinct. Also, that condition implies no integer $w$ such that $G=w\,H$ can be found by anyone. These facts are assumed or stated.


  
  $C=a\,G+b\,H$ is a point on the curve
  


Yes, though at some implementation level, it is a bitstring describing a point on the curve.


  
  How do I know that $b\,H$ is generated by $H$ without revealing $b$?
  


Anyone given a bitstring alleged to describe a point generated by $H$ can check that assertion, simply by checking that the bitstring indeed describes a point on the curve (which is feasible since the curve's equation and bitstring convention is public). Being generated by $H$ follows, since all points on the curve are generated by any generator (by definition of a generator), and $H$ is a generator.

Also: since the first-person locutor in this question cares about not revealing $b$, s/he knows $b$, thus can compute $b\,H$, which by construction is generated by $H$. If s/he makes that computation privately, that's an alternate way of making the verification without disclosing $b$.


  
  How do I know that $b\,H$ is not generated by $G$?
  


Point $b\,H$ is generated by $G$, even though it may not have been obtained by computation of $x\,G$ for some integer $x$. Obtaining integer $x$ such that $x\,G=b\,H$ not knowing random $b$ would be as hard as the discrete logarithm problem for $G$.



My guess is that the intended question 3 is:


  How do I know that the alleged $C=b\,H$ was obtained by computation of $b\,H$ without being revealed $b$?


As a verifier in a Pedersen commitment, you don't know that the alleged $C=b\,H$ was obtained by computation of $b\,H$ until being given $b$ by the prover, which is how s/he demonstrates $a=0$.

As rightly pointed in an other answer, there are different interactive protocols (when Pedersen commitment is not) allowing a prover to demonstrate knowledge of integer $b$ such that $b\,H$ is a certain public point, without revealing $b$. Schnorr protocol does so, as:


prover generates random integer $r$, computes and sends point $T\gets r\,H$
verifier generates and sends random integer $i$
prover computes and sends integer $s\gets i\,b+r\bmod n$, where $n$ is the (public) order of the curve
verifier knowing point $b\,H$ computes point $i\,(b\,H)$, then point $i\,(b\,H)+T$; computes point $s\,H$; and ensures $i\,(b\,H)+T=s\,H$.