Re: [CFRG] please use real names (was: Re: Small subgroup question for draft-irtf-cfrg-hash-to-curve)

[Soatok Dreamseeker <[e-mail]>]

On Sun, Apr 11, 2021 at 8:16 AM Squeamish Ossifrage
<squeamishossifrage.se=[e-mail]> wrote:
> Similarly, for example, in AES-GCM there is an almost unimaginably larger probability, 1/2^128, of choosing an all-zero GHASH evaluation point, under which the authenticator is independent of the message content.  But the probability is so small that nobody cares.  And ‘But what if you abuse map_to_curve on its own in a place where the adversary can manipulate the algebraic structure?’ is no more an argument against the complete hash_to_curve design than ‘But what if you abuse GHASH on its own in a place where the adversary can manipulate the algebraic structure?’ is an argument against the complete AES-GCM design.

An additional observation.

- AES has a 128-bit block size
- When you use 256-bit keys, there are about 2^128 different keys that
will map a single 128-bit plaintext block to a single 128-bit
ciphertext block

However, I believe this probability of H=[0x000...000] is zero,
because the AES block cipher is a PRP and the input is [0x000...000],
and as far as I'm aware, there are no known (P, k) pairs for which
E_k(P) = P.

If AES were a PRF instead of a PRP, the risk calculus here would be
different. (But also, the 128-bit block size would need to be 256-bit
to reach the same security under birthday bound assumptions.)

Regards,

S. Dreamseeker <https://soatok.blog>