Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-08.txt

[Michael Scott <[e-mail]>]

Hello Chris,

I have a few remarks about this. The changes I noted were a minor change to
ELL2, some sensible updating to the Domain Separation Tag formats, and that
the SVDW method seems to now be deprecated (or at least not recommended)
for curves with AB=0 in favour of the isogeny map based method.

I was puzzled that the suite for edwards25519 uses SHA-512, whereas surely
SHA-256 would be a better fit?

On a very mundane issue, in section 8.1 hash-to-field should be
hash_to_field.

My major concern is about the Isogeny map vs SVDW issue. It is not clear to
me that suitable isogeny mappings can be found for all potential
pairing-friendly curves of interest. Indeed for the well-known BN254 curve,
and adapting the sage script from https://eprint.iacr.org/2019/403, I was
unable to find any isogeny map of degree less than 64 for the G2 group. And
for another BLS12 curve I could find no isogeny of degree less than 100 for
G1 (although one of degree 3 existed for G2). The method already seems
unwieldy with its multiple constants, compared with SVDW.

It would be a useful exercise to provide isogeny maps for all of the
pairing-friendly curves under active consideration for standardisation by
CFRG, to confirm the general applicability of the method. It seems to me
that the isogeny map method may have been rather lucky with BLS12-381 !

Personally, I would support SVDW being reinstated as an equally recommended
alternative option.

Mike



On Tue, Jun 2, 2020 at 12:32 AM Christopher Wood <[e-mail]>
wrote:

> This update carries a number of important changes, including, though not
> limited to:
>
> - Domain separation mitigations for expand_message_xmd (as part of
> hash-to-field).
> - Mapping function fixes and clarifications. Elligator 2 alignment is one
> such update.
> - An overall reduction in suites. There is now one recommended RO and NU
> suite per target curve.
> - Expanded test vectors, including those for expand_message.
> - Much improved security considerations text, particularly around domain
> separation guarantees.
> - Alignment with the VRF specification [1].
>
> We believe the document is now ready for RGLC, and would appreciate
> reviews and feedback to help get it across the finish line.
>
> Thanks!
> Chris
>
> [1] https://github.com/fcelda/nsec5-draft/pull/35
>
> On Mon, Jun 1, 2020, at 4:17 PM, [e-mail] wrote:
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > This draft is a work item of the Crypto Forum RG of the IRTF.
> >
> >         Title           : Hashing to Elliptic Curves
> >         Authors         : Armando Faz-Hernandez
> >                           Sam Scott
> >                           Nick Sullivan
> >                           Riad S. Wahby
> >                           Christopher A. Wood
> >       Filename        : draft-irtf-cfrg-hash-to-curve-08.txt
> >       Pages           : 156
> >       Date            : 2020-06-01
> >
> > Abstract:
> >    This document specifies a number of algorithms for encoding or
> >    hashing an arbitrary string to a point on an elliptic curve.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/
> >
> > There are also htmlized versions available at:
> > https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-08
> > https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-08
> >
> > A diff from the previous version is available at:
> > https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-hash-to-curve-08
> >
> >
> > Please note that it may take a couple of minutes from the time of
> submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> >
> > _______________________________________________
> > Cfrg mailing list
> > [e-mail]
> > https://www.irtf.org/mailman/listinfo/cfrg
> >
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>