Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

[Loup Vaillant-David <[e-mail]>]

> The concern is akin to the generation of keys. For example, calling a
> PRGN(seed) to get a key K. Of course, the key generation procedure
> must ban the case of K=0. […]

That is far from obvious to me. Banning a key just reduces the search
space. Should we ban 0 because the attacker is more likely to test it
first? Then what about 1? Or 37? Or 2^256 - 1? Any published number? In
my opinion, the best solution is a uniform RNG. If we really want to
maximise unpredictability, we must not ban any number. Not even zero.

At least in the case of elliptic curves, one may argue that we should
ban the identity point because its properties are observably different
from all other points. Not just the bit pattern, but the fact that it
has order 1. (And even then I'd be cautious.)

Loup.