Re: [Cfrg] Comments regarding draft-sullivan-cfrg-hash-to-curve

[Christopher Wood <[e-mail]>]

Hi Jason,

Please see inline below.

On Tue, Apr 3, 2018 at 9:36 PM Jason Resch <[e-mail]> wrote:

>
> I recently wrote some reference implementations of my suggestion below for
> implementing HashToBase() for any given input string and curve.  It uses
> the left-most bits of HKDF applied to the input, where the number of total
> bits selected is determined by the size of the prime field.  I have ensured
> consistency via some test vectors I defined and are included in this sample
> code.  I tested both NIST P-256, and NIST P-521. Note that these examples
> only implement "Simplified SWU", but this can be easily extended to support
> the other algorithms.
>
> I have attached the Python and Java implementations to this e-mail, the
> python one is a bit more concise and is self contained in one file, while
> the Java one is implemented across several files (in the zip file), but
> both produce consistent results as far as I have been able to test.
>

Thanks for sharing the code. We're currently working to port all the
algorithms to hacspec. This routine will certainly be part of that effort.
When the time comes, I will use it to test against our own implementation.


>
> Also, I found something interesting in regards to supporting Koblitz
> curves, or other curves where a = 0 (such as BN-254).  By accident, I
> discovered that it didn't seem to matter whether I used "(-b / a)" or any
> other number.  The Simplified SWU algorithm appeared to always map to a
> valid point.  Does this make sense?  Is there a special motivation for
> using (-b / a) as opposed to some other constant?
>

Interesting. I don't know off hand. I'll have to investigate and get back
to you.

Best,
Chris