Subject: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-07.txt

From: [email-masked]
Date: Mon, 27 Apr 2020 10:33:29 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Crypto Forum RG of the IRTF.

        Title           : Hashing to Elliptic Curves
        Authors         : Armando Faz-Hernandez
                          Sam Scott
                          Nick Sullivan
                          Riad S. Wahby
                          Christopher A. Wood
	Filename        : draft-irtf-cfrg-hash-to-curve-07.txt
	Pages           : 159
	Date            : 2020-04-27

Abstract:
   This document specifies a number of algorithms that may be used to
   encode or hash an arbitrary string to a point on an elliptic curve.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-07
https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-07

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-hash-to-curve-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Björn Haase <[email-masked]>
Date: Tue, 28 Apr 2020 17:13:52 +0200

Hi H2C team,

I just had a short look at the draft. The first thing I have looked at
more closely is the expand_message_xmd function. There is something
which I don't understand in this construction regarding the Z_pad string
which is  prepended in the hash invocation for b_0.

Iwould understand a zero-padding that would first insert some
information that should be maintained confidential and a Z_pad string
that fills up the remaining rest of the input block of the hash function
with zeros. However, I did not get the point, why filling the first
block with zeros should provide any advantage.

Could somebody explain the reasoning?

Yours,

Björn

---

From: "Riad S. Wahby" <[email-masked]>
Date: Tue, 28 Apr 2020 09:31:15 -0700

Hi Björn,

> block with zeros should provide any advantage.

Good question! The answer is that this zero block allows one to prove
this construction indifferentiable from a random oracle when the M-D
compression function is modeled as a random oracle (which is effectively
the strongest statement we could hope for in this context).

In particular, prepending a block of zeros instantiates an NMAC
construction, as described in Section 3.5 of the following paper
(the full version linked below gives a security proof).

    Coron, Dodis, Malinaud, and Puniya. "Merkle-Damgaard revisited:
    How to construct a hash function." Proc. CRYPTO 2005.
    https://cs.nyu.edu/~dodis/ps/merkle.pdf

This is discussed in the "Security Considerations" section of the
document. I will go back and double check that Section 5 makes
a clear forward ref to that discussion.

Thanks for the feedback and take care,

-=rsw