Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

[Watson Ladd <[e-mail]>]

On Sat, Apr 10, 2021 at 10:52 AM Rene Struik <[e-mail]> wrote:
>
> Hi Hugo:
>
> It would be of interest what the impact of a "broken" hash function in the hash to curve construction on the security of password based schemes would be. In the case of mappings that always yield a high-order point, the impact may not immediately be obvious, while with mappings that do not preclude low-order points this might show more readily, also to offline observers. This may be an interesting addition to security proof papers that now focus mostly on idealized functionality (such as random oracles).
>
> As an aside, as I noted in my email of yesterday [1],  mappings that fix a particular image point for a specific input are trivial if the construction itself has "free variables" one could fix after the fact (e.g., pick delta such that delta*H("Hugo123")^2=t0), thereby yielding an immediate attack, irrespective of hash function functionality. See specific comment a) in [1].
>
> All in all, it seems that guaranteeing that curve mappings would never yield low-order points seems prudent, esp. if it comes at roughly the same computational cost as ones that do not give those assurances.

Good news: all the mappings we do provide that guarantee with the same
probability that we regard as negligible in cryptography.

Sincerely,
Watson
>
> Best regards, Rene