Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

[Björn Haase <[e-mail]>]

Dear Rene,

As a general rule for avoiding complexity as possible error source, I
would always only considera single mapping: the most efficient mapping
that is safely not covered by patents for a curve.


This means: For any Montgomery or Edwards curve, we probably should
concentrate on Elligator2 and not suggest use of SWU.

The second simple question IMO is P384. I'd not consider Icart's mapping
as long as the patents apply. I'd use plain SWU here.

Choice for P256 and other curves such as Brainpool with q = 3 mod 4
might be a bit more difficult. I'd suggest that we carry out a patent
review and stick to a simplified SWU version which avoids "-1" as
non-square if we have all consensus that this is not covered by known
patents. In case that there remains any un-certainty, I'd suggest to
stick to plain SWU as single mapping proposal for P256.

I believe that the possible benefit of the mapping for protocols such as
OPAQUE or AuCPace is so large that we should really avoid any doubt by
some people that the mapping might be covered by patents.

Yours,

Björn.


Am 22.07.2019 um 20:53 schrieb Rene Struik:
> Hi Armando:
>
> Thanks for your note. Curve448 is defined over a field GF(q) with q=3
> (mod 4), so it seems the simplified SWU mapping, as well as
> "Elligator2" (which can be viewed as a "repackaged" version of
> simplified SWU for Montgomery curves) both apply.
>
> Rene