Re: [Cfrg] RGLC on draft-irtf-cfrg-hash-to-curve-10

[Greg Hudson <[e-mail]>]

I have some concerns over the use of the terms "random" and "uniform" in
this document.

The term "random" is sometimes used to describe the output of
deterministic functions.  For instance, section 5 says "it first hashes
the input byte string to produce a uniformly random byte string", and
section 5.2 says that an alternative hash_to_field must output field
elements that are "uniformly random except with bias at most 2^-k".
hash_to_field is a deterministic function; it introduces no randomness.

The term "uniform" describes a probability distribution where all values
have equal probability.  There is an assumption in the document that
applying a hash function to an input string produces an output that is
somehow uniform or uniformly random, without discussing the input as
being selected from any particular probability distribution.

Perhaps there is a definition of "uniform" which makes this language
more rigorous, but the document does not define the term or provide a
reference, so I can only read it as having the meaning from probability.

I understand that the document wants to specify functions
indistinguishable from random oracles, and therefore needs to be
concerned with not introducing bias beyond what is intrinsic in the
input distribution.  (An example of bias intrinsic to the input
distribution would be hashing passwords to curve elements, where 90% of
the passwords are "mypassword".  One output element will necessarily
have 90% probability, no matter how random-looking that single element
might be.)  I unfortunately don't know how to rigorously describe that,
so can't suggest specific wording changes.