Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve Sat, 10 April 2021 21:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C4A133A1D64 for <>; Sat, 10 Apr 2021 14:56:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.4
X-Spam-Status: No, score=-1.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id hVnRAuS_ugSb for <>; Sat, 10 Apr 2021 14:56:44 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5EBDC3A1D62 for <>; Sat, 10 Apr 2021 14:56:44 -0700 (PDT)
Received: by with SMTP id c4so9560527qkg.3 for <>; Sat, 10 Apr 2021 14:56:44 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=CLABfmgdvHZEOPrhL1QbUm/sibQeC1lB7z3Nk10uy08=; b=rzZs8LkTdjwAm8x+CwGQHdRzdrXLTfsmtVMH0vY/T6rv7OT/AiqxHqn+QVdnxRHXUQ 42Ad7b0Pj2IHsxayN6lxn1ZcYO3ck8fMiYMZp0h93WWjzyM7AlIfeI/VXXKTkMUd8aZ9 s+Uhf1pcwKcXetEL4LqnpnbR6h6PYtOPC+lSasXaU7AkEbttfiNeL6a5hmH+Wi/qKsi7 MlLywii7KLWa/0QOdV1XvcsZ/Jn0TuEWpgOj8oi3vVP5wY1posTOAvVITD12AB0uSVKn UOB3kWGJcowjCKNuY84+fPLqicdWIyR4NPYMyPguaa1vwjSyGbIC0WW1q94dJdEdsDZO IKvw==
X-Gm-Message-State: AOAM5311YIoxRGff7zG/oLMxMOhGYT9Ele0exPfhxvXIlVK2n68CPqB3 pNebi6Qu7L2BH4SMb1vThqXeMIA5i0c=
X-Google-Smtp-Source: ABdhPJyJN6g8k40yFXrEN/W9aHtI/Rn+bX178Yc4RPVG7vAShHv4py6RB5YOQwVfslaICTW8afbQ4A==
X-Received: by 2002:a37:b8c6:: with SMTP id i189mr19834610qkf.456.1618091802999; Sat, 10 Apr 2021 14:56:42 -0700 (PDT)
Received: from localhost ( []) by with ESMTPSA id c19sm4647302qkl.78.2021. (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 10 Apr 2021 14:56:42 -0700 (PDT)
Date: Sat, 10 Apr 2021 17:56:40 -0400
To: "Hao, Feng" <>, CFRG <>
Message-ID: <20210410215640.v6lhjcs2pzu2hwk2@muon>
References: <> <> <> <> <trinity-f323065e-9f30-48fd-9ead-0865e8f877eb-1618002469856@3c-app-webde-bap03> <> <> <> <20210410151254.7ze5pt4lpvblhk3f@muon> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <>
Archived-At: <>
Subject: Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 10 Apr 2021 21:56:49 -0000

Hello Feng,

"Hao, Feng" <> wrote:
> That current map-to-curve functions don’t preclude low-order points
> is a known fact, and acknowledged by the authors in their papers.

The function that is being standardized is hash_to_curve, which has
the properties I listed in my prior email. Conforming implementations
of the hash-to-curve draft do not have the issue you have raised
in this thread, period, because no conforming implementation uses
one of the deterministic maps in a standalone way.

Further discussion of whether the deterministic maps described in the
hash-to-curve draft do or do not return low-order points is not a good
use of time. Yes, they do. We all know that. But that is irrelevant,
because they should never be used on their own.