[CFRG] hash_to_field requires implementing a new 25519 field op

[Filippo Valsorda <[e-mail]>]

Yawning Angel noticed that the current hash-to-curve draft requires implementing a new 25519 base field operation: wide reduction from 384-bit (or larger) inputs for hash_to_field. https://github.com/FiloSottile/edwards25519/issues/17

This is unfortunate, because most Curve25519 implementations probably don't already provide it, since simply reducing 255 random bits will have a chance of bias of less than 2⁻²⁵⁰, well within the security bounds of the curve.

There are two ways this can go: Curve25519 implementations will all have to implement and expose a new field operation (like https://git.io/JlU6L) which will be only used for h2c, meaning it will not be well tested or maintained, or h2c implementations will have to roll their own, probably in variable time.

Why is a 384-bit integer reduced in hash_to_field for Curve25519 instead of the regular 255 bits?