Re: [Cfrg] patent situation regarding hash2curve as used in some PAKE nominations

[Björn Haase <[e-mail]>]

Helly Riad,

yes I now agree with you. The point would also be that the modified
method does not at all refer to Skalba's equality. And in this case,
plain SWU is indeed something not to include in the hash2curve draft.

Also this would also avoid the annoying restriction for avoiding use of
the y-coordinate! I'll look more closely at it this weekend.

Yours,

Björn


Am 21.10.2019 um 17:55 schrieb Riad S. Wahby:
> Hello Bjorn,
>
> As I pointed out off-list, and to be completely explicit: X3(t)=Z is
> not a counter-argument to my prior message since Skalba's inequality
> requires a polynomial X3(t) such that
>
>      f(X1(t)) * f(X2(t)) * f(X3(t)) == U(t)^2
>
> and the point of choosing Z as we have is that there does not exist
> any polynomial X3(t) such that f(X3(t)) == Z.
>
> "\"Björn Haase\"" <[e-mail]> wrote:
>>     - We might be better still including "plain" SWU as an option for mapping
>>     in the hash2curve draft.
> As I've said in the past, there is no reason to ever use "plain" SWU.
> The map of Shallue and van de Woestijne has exactly the same cost and
> is strictly more general. (We will certainly include the S-vdW map.)
>
> Regards,
>
> -=rsw
>