Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-08.txt

[Marek Jankowski <[e-mail]>]

Hi Chris,
I think this is a great draft - it explains very well hashing to curves,
which is vital for many new applications that I hope to see coming, mainly
those using pairings.
The section about domain separation is very important and I'm glad to see
it explained explicitly and thoroughly.
Here are a few suggestions, most of them minor:
a. I think Table 1 (Sec. 2.1) could be better formatted, using less line
breaks. Please consider redistributing the widths of the columns.
b. The second paragraph in 2.2.1 can be simplified: it suffices to say it
needs not be bijective/surjective/injective. Also I'm not entirely sure
it's best practice to use the term 'invertible' for just _efficiently_
reversible functions.
c. I think a better formulation in the first paragraph in 2.2.5 is
something like "...assuming the attacker accesses RO only through the
protocol, viz. the RO is not used elsewhere."
d. The word 'encode' (Sec. 3) implies that its output can be decoded.
Perhaps there's a better word for noninvertible maps.
e. Domain separation (Sec. 3.1): I believe that if needed for backwards
compatibility, it is not a disaster if we omit the version number from the
Tag. Maybe it is worth a "NOT RECOMMENDED".
f. It says that expand_message MUST NOT use rejection sampling (5.3.4). To
the best of my understanding, rejection sampling is to be avoided for the
sole purpose of mitigating side channel attacks; this is defined (Sec. 4)
as a SHOULD, so I believe this SHOULD should (no pun intended :-) propagate
there.
g. Do we really want to approve as many curves as in [Table 2, Sec. 8]? We
are standardizing something new here, so we can allow ourselves to stick to
just the best curves. In my opinion Curve25519 is in every way superior to
the NIST curve of the same strength, so the latter can be omitted.
Again, I am very supportive of the draft and will be happy to further help
in the process.

Cheers,
Marek

On Tue, Jun 2, 2020 at 1:32 AM Christopher Wood <[e-mail]> wrote:

> This update carries a number of important changes, including, though not
> limited to:
>
> - Domain separation mitigations for expand_message_xmd (as part of
> hash-to-field).
> - Mapping function fixes and clarifications. Elligator 2 alignment is one
> such update.
> - An overall reduction in suites. There is now one recommended RO and NU
> suite per target curve.
> - Expanded test vectors, including those for expand_message.
> - Much improved security considerations text, particularly around domain
> separation guarantees.
> - Alignment with the VRF specification [1].
>
> We believe the document is now ready for RGLC, and would appreciate
> reviews and feedback to help get it across the finish line.
>
> Thanks!
> Chris
>
> [1] https://github.com/fcelda/nsec5-draft/pull/35
>
> On Mon, Jun 1, 2020, at 4:17 PM, [e-mail] wrote:
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > This draft is a work item of the Crypto Forum RG of the IRTF.
> >
> >         Title           : Hashing to Elliptic Curves
> >         Authors         : Armando Faz-Hernandez
> >                           Sam Scott
> >                           Nick Sullivan
> >                           Riad S. Wahby
> >                           Christopher A. Wood
> >       Filename        : draft-irtf-cfrg-hash-to-curve-08.txt
> >       Pages           : 156
> >       Date            : 2020-06-01
> >
> > Abstract:
> >    This document specifies a number of algorithms for encoding or
> >    hashing an arbitrary string to a point on an elliptic curve.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/
> >
> > There are also htmlized versions available at:
> > https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-08
> > https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-08
> >
> > A diff from the previous version is available at:
> > https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-hash-to-curve-08
> >
> >
> > Please note that it may take a couple of minutes from the time of
> submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> >
> > _______________________________________________
> > Cfrg mailing list
> > [e-mail]
> > https://www.irtf.org/mailman/listinfo/cfrg
> >
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>