Re: [Cfrg] Comments regarding draft-sullivan-cfrg-hash-to-curve

[Christopher Wood <[e-mail]>]

Hi David,

Please see inline below for comments.

On Wed, Mar 21, 2018 at 2:57 AM David Núñez <[e-mail]> wrote:

> Hi all,
> I am too very interested in supporting this RFC, I think it’s very
> necessary. Apart from the good points raised by Jason in the previous mail,
> I have some comments for the Try-and-increment method in Appendix A.
> Although it is an appendix, I believe special care should be taken into
> this function too, since it’s very attractive due its simplicity and
> generality (of course, when timing attacks are not a concern).
>

We can and probably should make this side channel more clear in the
appendix. The current text only hints at it.


>
> Comments:
> - Current pseudocode relies on I2OSP failing to avoid looping forever when
> ctr > 256^4. Although this only happens with probability 2^-32, perhaps it
> should be an explicit condition for the loop. This should also be
> acknowledged in the introduction, since the size of this counter determines
> the probability of failure, as in the MapToGroup approach.
>

Very good point. I filed:
https://github.com/chris-wood/draft-sullivan-cfrg-hash-to-curve/issues/13


> - Clarify the meaning of "2n-octet string” when introducing RS2ECP. Also,
> RS2ECP is not explicitly defined in RFC8032, but in
> https://tools.ietf.org/id/draft-goldbe-vrf-01.html#suites. According to
> that, only when curve is Ed25519, RS2ECP is defined in Section 5.1.3 of
> [RFC8032].
>

Another good point. I filed:
https://github.com/chris-wood/draft-sullivan-cfrg-hash-to-curve/issues/14

Thanks again for your feedback.

Best,
Chris


>
>