Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

   Hello,

   This draft seems like a departure from the direction -03 was going,
which is unfortunate.

   Version -03 had several methods of hashing whose preconditions made them
appropriate for certain curves. Importantly, though, it had SWU which will
work with basically any Weierstrass curve. Now it seems the focus is on 
highly
optimized and curve-specific methods and ciphersuites which fix the curve
and hash algorithm. SWU is now optimized to work only on certain 
pairing-friendly
curves.

   Would it be possible to add back the -03 SWU as a generic template that
can be instantiated with a curve and a hash function? That was how I was
planning on using this soon-to-be RFC.

   And a comment on -04. The Simple SWU method now has a check whether u=0
to prevent divide-by-zero. In the event it is, the algorithm outputs
B/(Z * A) as x. Doesn't this leak information? If I, as a passive observer,
notice x = B/(Z * A) then I know that hash_to_curve(m) returned 0. I know
the probability of u=0 is astronomically small but if the possibility is
going to be addressed why not reduce the output of the hash modulo (p-2)
and then add 2 to always place 1 < u < p?

   regards,

   Dan.

On 7/8/19 4:32 PM, internet-drafts@ietf.org wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Crypto Forum RG of the IRTF.
>
>          Title           : Hashing to Elliptic Curves
>          Authors         : Armando Faz-Hernandez
>                            Sam Scott
>                            Nick Sullivan
>                            Riad S. Wahby
>                            Christopher A. Wood
> 	Filename        : draft-irtf-cfrg-hash-to-curve-04.txt
> 	Pages           : 60
> 	Date            : 2019-07-08
>
> Abstract:
>     This document specifies a number of algorithms that may be used to
>     encode or hash an arbitrary string to a point on an elliptic curve.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-04
> https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-04
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-hash-to-curve-04
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg