Re: [Cfrg] hash-to-curve updates and suite reduction

[Christopher Wood <[e-mail]>]

Hi Mike,

Apologies for the delay, and thanks for raising this point. Please see inline below.

On Fri, May 1, 2020, at 4:52 PM, Mike Hamburg wrote:
> Hello Christopher,
> 
> Sorry to be so late in the game on this, but I have a concern about 
> Elligator 2 as defined in hash-to-curve.
> 
> One of the nice properties of Elligator 2 is that it’s an injective map 
> on [0..(p-1)/2], which is useful for canonically inverting the map.  
> However, the draft version is not injective on this domain.  Wouldn’t 
> it be better to choose sgn(t) according to is_square(gx1) instead of 
> according to sgn(u)?  That would also make it match the paper, except 
> for the different definitions of sgn().

I agree that inverting the map can be quite useful for some applications. However, to the best of my recollection, we haven't heard requests for this injective property in the past. I don't have a particularly strong opinion on this point, so I'm curious to hear what others here think about this proposal. 

Best,
Chris