Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

"Riad S. Wahby" <rsw@jfet.org> Sat, 10 April 2021 22:09 UTC

Return-Path: <rswatjfet.org@gmail.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 161D43A1DE9 for <cfrg@ietfa.amsl.com>; Sat, 10 Apr 2021 15:09:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.4
X-Spam-Level:
X-Spam-Status: No, score=-1.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pJQTShmTQ0bA for <cfrg@ietfa.amsl.com>; Sat, 10 Apr 2021 15:09:11 -0700 (PDT)
Received: from mail-qk1-f172.google.com (mail-qk1-f172.google.com [209.85.222.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B373E3A1DE6 for <cfrg@irtf.org>; Sat, 10 Apr 2021 15:09:11 -0700 (PDT)
Received: by mail-qk1-f172.google.com with SMTP id c123so4731058qke.1 for <cfrg@irtf.org>; Sat, 10 Apr 2021 15:09:11 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=LmL52sk9Rp/7PyLhsrLFSnBQiIvG/M/mLRZfyCn20rA=; b=erXLpbp+i6KbCNO0comRVPS7dRshZBDvMmZTt4yAAy3JLpENkgDddqChOCGEI3+H8Z yAkhot+PoQn2MTFrk+xn+ylnkC2roWoSm2yEiJZ0ReAxlMYEgv6pS77DRsG9qoY9YCPg fFR2TU+oIoETPDkkri4BvXmEC06G9XTLb5o5Ne8Nx5Ea4tAhONEGUUmDA5dHJIWtJPvW SWrM9957pswhrWxu8Mi0E0VuJBvxKX9ie8ItOPQ4QD9i7ZXETqn+/REiTgLXUADNLIRq 5Euj801y5aYmYEuRlJ/yKQhH6r0WLZtiJPoKD7yNt/3gS9B7N5n3i+8hH7SMaNzpJiS8 nYDg==
X-Gm-Message-State: AOAM533hZUTQ1Ovb6N2Hd+q1f5ALxZEbqgDqYsjd4xXv7YCEzd8+Ibhw T3m+FA+ky+ZUaseowYFiDnOin7l4Kc8=
X-Google-Smtp-Source: ABdhPJyE43xxxLPjSbmlD2hZbCR6to/yodIao3eK/BFOkJ5j9SZkFB52B9bJC5+4JNjBryFuhcs2Xg==
X-Received: by 2002:a05:620a:755:: with SMTP id i21mr2309943qki.130.1618092550759; Sat, 10 Apr 2021 15:09:10 -0700 (PDT)
Received: from localhost (mobile-166-177-56-20.mycingular.net. [166.177.56.20]) by smtp.gmail.com with ESMTPSA id e2sm4614947qto.50.2021.04.10.15.09.09 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 10 Apr 2021 15:09:10 -0700 (PDT)
Date: Sat, 10 Apr 2021 18:09:08 -0400
From: "Riad S. Wahby" <rsw@jfet.org>
To: Mike Hamburg <mike@shiftleft.org>, CFRG <cfrg@irtf.org>
Message-ID: <20210410220908.fjmndpewtlxa4isk@muon>
References: <CAMr0u6=PBX1W5zQFmpxKQ=ViUXN9QK00BREL4M0=2HOkaXaiZw@mail.gmail.com> <VI1SPR01MB03573585C37B871D200ECC23D6739@VI1SPR01MB0357.eurprd01.prod.exchangelabs.com> <trinity-f323065e-9f30-48fd-9ead-0865e8f877eb-1618002469856@3c-app-webde-bap03> <VI1SPR01MB035772443E4DA3206E4CD4D3D6739@VI1SPR01MB0357.eurprd01.prod.exchangelabs.com> <7944D4F1-81F8-44FC-95D1-45D47733B385@shiftleft.org> <VI1SPR01MB03574E592790FD59C1ACEB84D6729@VI1SPR01MB0357.eurprd01.prod.exchangelabs.com> <A1BFD5D1-00E2-4ACB-B55A-D18033229FF6@shiftleft.org> <VI1SPR01MB0357E0F2D567D0C8B81EE31AD6729@VI1SPR01MB0357.eurprd01.prod.exchangelabs.com> <64982C96-4594-493A-A7F8-9AAD984A83EE@shiftleft.org> <491484D0-BBF6-4B4A-B1B3-99E4951AF677@shiftleft.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <491484D0-BBF6-4B4A-B1B3-99E4951AF677@shiftleft.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/f9t_V-W4TBzT86uL6JpWtS1IqEc>
Subject: Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sat, 10 Apr 2021 22:09:16 -0000

Hi Mike,

I'm really sorry for a pedantic email. I just want to head off
potential confusion:

Mike Hamburg <mike@shiftleft.org> wrote:
> Replying to myself here, because I forgot to mention: as in most
> other uses of hash/map to curve, PAK-EC is provably secure even
> for somewhat nonuniform outputs, such as map_to_curve outputs.
> It’s just most secure with uniform outputs.

The function you're referring to, which has a non-uniform output
distribution, is called encode_to_curve in the draft. As you say,
PAK-EC remains secure with encode_to_curve.

(I'm being pedantic here because there seems to be some confusion
in this thread over whether it is recommended to directly use one
of the deterministic maps as a hash function---which of course it
is not---and we use the term map_to_curve to mean those maps.)

Cheers,

-=rsw