Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

[Armando Faz <[e-mail]>]

> That?s certainly a convenient solution. However, a proper one would be to preclude small subgroup points by design. The real problem here is to ensure mapping to points in the ?correct? group on an elliptic curve, not just any point. The current draft doesn?t solve that real problem (yet). I don?t think this is impossible to solve, but it needs some more efforts.
>
> Cheers,
> Feng

Let me just clarify that the hash to curve functions described in the
draft is a composition of
 H(x) := clear-cofactor( map-to-point ( hash-to-field (x)))

This hash function always gives you an element in the prime-order
subgroup of the curve E(Fp)[q]. That means that it can return either
 - a point of order q, or
 - the identity point.

No low-order points are returned, so the concern that you have raised
is not a problem, and it is already solved by the clear-cofactor
function.

The probabilities of getting in the identity were already described in
previous emails. And the fact that H returns the identity point is not
a failure nor a lack of completeness.

OTOH, the calling protocol could need some specific property about the
points produced by H. For example, ensuring points are different from
the identity. That being said, the protocol is who is in charge of
banning those points.

The concern is akin to the generation of keys. For example, calling a
PRGN(seed) to get a key K. Of course, the key generation procedure
must ban the case of K=0. However, nothing is wrong with the PRNG
returning K=0 (with low probability).

I could recommend adding a couple of lines in the Security
Recommendation section about it, but definitely it is not a problem.

-- 
Armando Faz
Cloudflare Inc.