Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

[Dan Harkins <[e-mail]>]

On 7/22/19 1:22 PM, Riad S. Wahby wrote:
> On July 22, 2019 4:08:25 PM EDT, "Björn Haase" <[e-mail]> wrote:
>> The second simple question IMO is P384. I'd not consider Icart's mapping
>> as long as the patents apply. I'd use plain SWU here.
> The generalized version of Simplified SWU given in -04 also applies to P384. So the question of which map to use for P384 is an instance of the broader question you asked, namely, are we comfortable with the IPR situation surrounding Simplified SWU? (I don't know! but maybe we'll understand more about this soon.)
>
> So: if P256 ends up using Simplified SWU, P384 can as well.
>
> (I certainly agree that we should be leery of the Icart IPR issues.)

   My original request to add back SWU was so I could have 1 method that 
worked
for the majority of curves that can be instantiated with a particular curve
and a particular hash function. I thought the trend from -03 to -04 was for
ciphersuite-style methods where if you're using curve foo you do one kind of
hash to curve with one particular hash algorith and if you're using 
curve bar
you use a different hash to curve method with a different hash 
algorithm. From
a programming point of view the latter is sub-optimal as I have to implement
a whole slew of hash to curve methods if I want to support a slew of curves
(where slew > 3).

   If the Simplified SWU of -04 also applies to all the curves that SWU 
does
then that complaint goes away. One issue with the Simplified SWU of -04, 
though,
is that I need the parameter Z for the curve so I either need to derive a Z
for every curve my code is going to support and store it (perhaps along with
the rest of the domain parameter set) or I derive it on the fly which sounds
like more looping which I want to avoid.

   So I still have a slight preference for the long-form SWU from -03 to
return in -05. Having ciphersuites for people who prefer that sort of thing
is fine but just don't make that the only way to go. Patents are, of course,
show stoppers.

   regards,

   Dan.