Re: [CFRG] Does OPRF/OPAQUE require full implementation of RFC 9380

[stef <[e-mail]>]

hey, Stefan.

On Sat, Mar 30, 2024 at 12:56:10PM +0100, Stefan Santesson wrote:
> Note that there are not even a "MUST" expressed here. Just a "must" and
> therefore not a requirement according to section 1.1.

nothing really is a must, but if you don't implement the hashtogroup as per
the rfc you will not be able to satisfy the test vectors, and if you don't
satisfy the test vectors it is difficult to claim compliance with the rfc. and
also compatibility with all the other implementations. if that is ok with you,
you should be doing whatever you want.

tbh i also think this is overkill since for some groups, like ristretto255 for
example there is a widely used hashtogroup available in most big
implementations (like crypto_scalarmult_ed25519 and
crypto_core_ristretto255_from_hash in libsodium). but i do understand that for
other curves this might be more involved, and seems to be also problematic as
- afaik - there has been for 20 years attempts made at defining a hashtogroup
that applies to all widely used - standardized - groups be it curves or dlog...

> Finally, is there any support for G.hashToGroup being planned in any major
> libraries supporting OPRF/OPAQUE?

i don't quite understand what you mean with "being planned", as as far as i
know all of the implementations that satisfy the test vectors have this
implemented, and liboprf
https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3P9keM4KFAMp8wZuULi71VS7cWwp/tree/src/oprf.h#L105
exports this also via the .h file. i suppose all others conforming to
testvectors do so too.

greets,
stefan