Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

[Rene Struik <[e-mail]>]

Hi Armando:

Thanks for your note. Curve448 is defined over a field GF(q) with q=3 
(mod 4), so it seems the simplified SWU mapping, as well as "Elligator2" 
(which can be viewed as a "repackaged" version of simplified SWU for 
Montgomery curves) both apply.

Rene

On 7/22/2019 2:40 PM, Armando Faz wrote:
> Revisiting Ulas' paper [1], the Theorem 2.3 proposes two methods:
>  - one for Weierstrass curves of the form: y^2 = x^n+ax+b, which 
> includes almost all elliptic curves except those with a=0 or b=0.
>  - and another one for curves of the form: y^2=x^n+ax^2+bx, which 
> includes Montgomery curves except those with a=0 or b=0.
>
> Although there exist faster methods for hashing (e.g. the simplified 
> SWU, Icart's, and Elligator2), the SWU method has the advantage of 
> supporting more curves at the cost of evaluating several expensive 
> operations.
>
> Example 1: Hashing methods for P-256 curve: simplified SWU and SWU.
> Example 2: Hashing methods for Curve448: Elligator2 and SWU.
>
> Hence, SWU can be used as a last resort in case one of the faster 
> methods can not be applied.
>
> [1] Ulas, Rational Points on Certain Hyperelliptic Curves over Finite 
> Fields.
>
> -- 
> Armando Faz
> Cloudflare Inc.
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]