Re: [CFRG] please use real names (was: Re: Small subgroup question for draft-irtf-cfrg-hash-to-curve)

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

>   . . . my understanding is that it is possible to participate in IRTF pseudonymously while complying with the Note Well.

It sure is - just counterproductive in many cases.


    > On 10 Apr 2021, at 16:34, Rene Struik <[e-mail]> wrote:
    > 
    > Hi "rsw":
    > 
    > As a general courtesy, may I suggest that all communications use people's real names and not some obscure acronym.
    > 
    > The CFRG is supposed to be a research forum, where people do not hide their identity. In fact, in my opinion, IETF should have no place for communications by "anonymous".
    > 
    > Rene
    > 
    > On 2021-04-10 11:12 a.m., [e-mail] wrote:
    >> Hello Feng,
    >> 
    >> "Hao, Feng" <Feng.Hao=[e-mail]> wrote:
    >>> Rsw also gave a similar example of having all zeros for the hash.
    >>> Let me clarify that we are not – and shouldn’t be - concerned with
    >>> any of such cases since the values are uniformly distributed within
    >>> their respective range.
    >> Right. And the argument is precisely the same for hash-to-curve!
    >> 
    >> Let me be perfectly clear: the property that hash_to_curve gives
    >> is that the output is a uniformly* distributed point in the (big)
    >> prime-order subgroup of the target elliptic curve.
    >> 
    >> At the risk of seeming didactic (in which case, apologies): the
    >> identity element is indeed an element of the target group G.
    >> 
    >> Put another way: fix a generator g of group G of prime order q. Then,
    >> hash_to_curve returns g^r in G, for r sampled uniformly* at random
    >> in 0 <= r < q. Under the assumption that discrete log is hard in G,
    >> hash_to_curve does not reveal r. Under the preimage and collision
    >> resistance of the underlying hash function, one cannot choose any
    >> particular r or find two inputs that hash to the same r.
    >> 
    >> I hope this helps clarify the security properties, and why focus
    >> on low-order points at intermediate steps of the computation is not
    >> relevant to the security of hash_to_curve as specified.
    >> 
    >> * uniformly except for some statistical distance less than 2^-100.
    >> 
    >> Regards,
    >> 
    >> -=rsw
    >> 
    >> _______________________________________________
    >> CFRG mailing list
    >> [e-mail]
    >> https://www.irtf.org/mailman/listinfo/cfrg
    > 
    > 
    > -- 
    > email: [e-mail] | Skype: rstruik
    > cell: [phone] | US: [phone]
    > 
    > _______________________________________________
    > CFRG mailing list
    > [e-mail]
    > https://www.irtf.org/mailman/listinfo/cfrg


    -- 
    Colin Perkins
    https://csperkins.org/




    _______________________________________________
    CFRG mailing list
    [e-mail]
    https://www.irtf.org/mailman/listinfo/cfrg