Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

["Hao, Feng" <[e-mail]>]

> Let me just clarify that the hash to curve functions described in the
draft is a composition of
 H(x) := clear-cofactor( map-to-point ( hash-to-field (x)))

> This hash function always gives you an element in the prime-order
subgroup of the curve E(Fp)[q]. That means that it can return either
 - a point of order q, or
 - the identity point.

> No low-order points are returned, so the concern that you have raised
is not a problem, and it is already solved by the clear-cofactor
function.

As explained in my first email on this subject, we can remove clear-cofactor from discussion here as it doesn’t do any help to resolve the issue: it simply changes a low-order point to an identity point. The fundamental question about the small subgroup remains.

> OTOH, the calling protocol could need some specific property about the
points produced by H. For example, ensuring points are different from
the identity. That being said, the protocol is who is in charge of
banning those points.

As explained earlier to Scott, it’s not a simple case of checking the identity and banning it. If you get a low-order point or an identity point (after clear-co-factor) from hash to curve, you can’t accept it nor reject it (the fact of reject instantly allows offline dictionary attacks)

> The concern is akin to the generation of keys. For example, calling a
PRGN(seed) to get a key K. Of course, the key generation procedure
must ban the case of K=0. However, nothing is wrong with the PRNG
returning K=0 (with low probability).

I think this is a completely different case. If it’s an AES key, you should of course generate the key at random without pruning.  If it’s for a public key and the key needs to satisfy certain conditions, you need to check if such conditions are fulfilled and if not re-generate it. The issue here is that if the mapped point doesn’t fulfil a property (say falling in a small subgroup), you cannot re-generate it, as doing so will allow trivial side-channel attacks.