[CFRG] please use real names (was: Re: Small subgroup question for draft-irtf-cfrg-hash-to-curve)

[Rene Struik <[e-mail]>]

Hi "rsw":

As a general courtesy, may I suggest that all communications use 
people's real names and not some obscure acronym.

The CFRG is supposed to be a research forum, where people do not hide 
their identity. In fact, in my opinion, IETF should have no place for 
communications by "anonymous".

Rene

On 2021-04-10 11:12 a.m., [e-mail] wrote:
> Hello Feng,
>
> "Hao, Feng" <Feng.Hao=[e-mail]> wrote:
>> Rsw also gave a similar example of having all zeros for the hash.
>> Let me clarify that we are not – and shouldn’t be - concerned with
>> any of such cases since the values are uniformly distributed within
>> their respective range.
> Right. And the argument is precisely the same for hash-to-curve!
>
> Let me be perfectly clear: the property that hash_to_curve gives
> is that the output is a uniformly* distributed point in the (big)
> prime-order subgroup of the target elliptic curve.
>
> At the risk of seeming didactic (in which case, apologies): the
> identity element is indeed an element of the target group G.
>
> Put another way: fix a generator g of group G of prime order q. Then,
> hash_to_curve returns g^r in G, for r sampled uniformly* at random
> in 0 <= r < q. Under the assumption that discrete log is hard in G,
> hash_to_curve does not reveal r. Under the preimage and collision
> resistance of the underlying hash function, one cannot choose any
> particular r or find two inputs that hash to the same r.
>
> I hope this helps clarify the security properties, and why focus
> on low-order points at intermediate steps of the computation is not
> relevant to the security of hash_to_curve as specified.
>
> * uniformly except for some statistical distance less than 2^-100.
>
> Regards,
>
> -=rsw
>
> _______________________________________________
> CFRG mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]