Re: [CFRG] Comment on draft-irtf-cfrg-hash-to-curve-10

[Daira Hopwood <[e-mail]>]

On 04/01/2021 13:40, Daira Hopwood wrote:
> A prototype specialized for n = 32 and the
> [Pallas/Vesta](https://electriccoin.co/blog/the-pasta-curves-for-halo-2-and-beyond/) 
> 
> curves is at https://github.com/zcash/pasta/squareroottab.sage .

Corrected URL:
https://github.com/zcash/pasta/blob/master/squareroottab.sage

> Now given divsqrt, we can apply another optimization in section 4.2
> of [WB2019] that avoids needing to test whether gx1 (using the notation
> of the Internet Draft) is square. In brief: we first compute the
> numerators and denominators for x1 = N/D and gx1 = U/V as in the
> paper. If gx1 is not square, then we have sqrt(h * gx1); using a
> precomputed square root of Z/h, we can calculate the numerators and
> denominators of x2 and y2, without ever needing to calculate gx2.
> The detail is explained in comments at
> https://github.com/zcash/pasta/hashtocurve.sage .

Corrected URL:
https://github.com/zcash/pasta/blob/master/hashtocurve.sage

-- 
Daira Hopwood