Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

[[e-mail]]

Hello Feng,

"Hao, Feng" <Feng.Hao=[e-mail]> wrote:
> Rsw also gave a similar example of having all zeros for the hash.
> Let me clarify that we are not – and shouldn’t be - concerned with
> any of such cases since the values are uniformly distributed within
> their respective range.

Right. And the argument is precisely the same for hash-to-curve!

Let me be perfectly clear: the property that hash_to_curve gives
is that the output is a uniformly* distributed point in the (big)
prime-order subgroup of the target elliptic curve.

At the risk of seeming didactic (in which case, apologies): the
identity element is indeed an element of the target group G.

Put another way: fix a generator g of group G of prime order q. Then,
hash_to_curve returns g^r in G, for r sampled uniformly* at random
in 0 <= r < q. Under the assumption that discrete log is hard in G,
hash_to_curve does not reveal r. Under the preimage and collision
resistance of the underlying hash function, one cannot choose any
particular r or find two inputs that hash to the same r.

I hope this helps clarify the security properties, and why focus
on low-order points at intermediate steps of the computation is not
relevant to the security of hash_to_curve as specified.

* uniformly except for some statistical distance less than 2^-100.

Regards,

-=rsw