Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

[Armando Faz <[e-mail]>]

Revisiting Ulas' paper [1], the Theorem 2.3 proposes two methods:
 - one for Weierstrass curves of the form: y^2 = x^n+ax+b, which includes
almost all elliptic curves except those with a=0 or b=0.
 - and another one for curves of the form: y^2=x^n+ax^2+bx, which includes
Montgomery curves except those with a=0 or b=0.

Although there exist faster methods for hashing (e.g. the simplified SWU,
Icart's, and Elligator2), the SWU method has the advantage of supporting
more curves at the cost of evaluating several expensive operations.

Example 1: Hashing methods for P-256 curve: simplified SWU and SWU.
Example 2: Hashing methods for Curve448: Elligator2 and SWU.

Hence, SWU can be used as a last resort in case one of the faster methods
can not be applied.

[1] Ulas, Rational Points on Certain Hyperelliptic Curves over Finite
Fields.

-- 
Armando Faz
Cloudflare Inc.