Re: [Cfrg] using hash2curve in a protocol

["Riad S. Wahby" <[e-mail]>]

Mathy Vanhoef <[e-mail]> wrote:
> Because similar changes are also being proposed in an update to the
> Wi-Fi standard, one remark is that in the simplified_swu and
> hash_to_ffc routine you can use PBKDF2 or similar instead of HKDF.
> This will make possible brute-force attacks (e.g. due to
> implementation issues or other side-channels) more costly.

This is a great suggestion. To keep things modular, it might be
reasonable to treat the output of PBKDF2 (or bcrypt, scrypt, ...)
as the input to the hash-to-curve or hash-to-field algorithm
rather than merging the two. This ends up requiring some extra HKDF
invocations, but at least when hashing to curves those are cheap
relative to other costs. (This is likely also true when hashing to
a mod-p subgroup, since there's an exponentiation at the end.)

In any case, a small bit of care is warranted: roughly speaking,
the underlying hash function needs to give collision resistance
commensurate with the security level of the target curve or field.
For example, processing a password with PBKDF2-HMAC-SHA256 before
hashing to Ed448 isn't great, but PBKDF2-HMAC-SHA512 would be.

Regards,

-=rsw