Re: [Cfrg] Comments regarding draft-sullivan-cfrg-hash-to-curve

[David Núñez <[e-mail]>]

Hi all,
I am too very interested in supporting this RFC, I think it’s very necessary. Apart from the good points raised by Jason in the previous mail, I have some comments for the Try-and-increment method in Appendix A. Although it is an appendix, I believe special care should be taken into this function too, since it’s very attractive due its simplicity and generality (of course, when timing attacks are not a concern).  

Comments:
- Current pseudocode relies on I2OSP failing to avoid looping forever when ctr > 256^4. Although this only happens with probability 2^-32, perhaps it should be an explicit condition for the loop. This should also be acknowledged in the introduction, since the size of this counter determines the probability of failure, as in the MapToGroup approach.
- Clarify the meaning of "2n-octet string” when introducing RS2ECP. Also, RS2ECP is not explicitly defined in RFC8032, but in https://tools.ietf.org/id/draft-goldbe-vrf-01.html#suites <https://tools.ietf.org/id/draft-goldbe-vrf-01.html#suites>. According to that, only when curve is Ed25519, RS2ECP is defined in Section 5.1.3 of [RFC8032].

Regards,
David