[CFRG] Re: Can hash_to_field hash to mod (p-1)?

[Mike Hamburg <[e-mail]>]

Hello Emil,

Yes, the outputs are very close to uniformly random even if p isn’t a prime.  The same method — generate extra random bits, reduce mod p-1, add 1 — is used in FIPS 186-5 §A.3.1.

Regards,
— Mike

PS: As a small correction, Z/q is only a field if q is prime.  Being a power of a prime isn’t enough: the Galois fields GF(q^n) are not the same as Z/q when n > 1.

> On 3 Aug 2026, at 17:30, Emil Lundberg <emil=[e-mail]> wrote:
> 
> Hi CFRG,
> 
> I have a question about the hash_to_field function defined in RFC 9380 [1]: Can hash_to_field be used to securely hash to an integer mod (p-1), for some (large) prime p?
> 
> I know that Z_{p-1} is not a field unless p-1 happens to be a power of two (very unlikely as p would have to be a Fermat prime), but it's not clear to me whether hash_to_field outputs are (approximately) uniformly random _only_ for prime p, or if that's just what's relevant for RFC 9380 itself. My guess would be that uniformity is preserved when p is coprime to 2^8L? (which does not hold for p-1 then, since p-1 is even)
> 
> The reason I'm asking is for whether you could use hash_to_field(r-1)+1 to securely hash to a nonzero scalar mod r, for secret keys, message representatives and the like. This would be an infallible way to do so in constant time, as opposed to rejection sampling for a nonzero result (not constant time) or accepting the negligible probability of a bad result (practically infallible, but nonzero probability in principle) as advocated in section 10.1 of RFC 9380 [2].
> 
> This thought occurred to me as I was reviewing draft-irtf-cfrg-bls-signature-07, which uses HKDF mod r and rejection sampling to generate nonzero scalars as private keys, and I was reminded of it by Michele Orrù's recent message on draft-irtf-cfrg-pairing-friendly-curves [3] which remarks/proposes that "Sampling APIs distinguish between sampling from [0, r - 1] and sampling from [1, r - 1]".
> 
> I'm sure someone has considered this before and discarded it as a bad idea, but I haven't found any documentation on whether it works or fails. Can someone point me to any relevant reading?
> 
> [1]: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-a-finite-field
> [2]: https://www.rfc-editor.org/rfc/rfc9380.html#name-properties-of-encodings
> [3]: https://mailarchive.ietf.org/arch/msg/cfrg/K8sgyB7qT-tGTAOKtsngV6n0Slg/
> 
> Emil Lundberg
> Staff Engineer | Yubico <http://www.yubico.com/>
> 
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]