Subject: [Cfrg] request for comments: hashing to ristretto255

From: [email-masked]
Date: Wed, 12 Aug 2020 13:20:21 -0700

Hello,

I'm writing on behalf of the hash-to-curve authors to request feedback
on a proposed appendix for the hash-to-curve draft that specifies
a method for hashing to ristretto255.

The proposed appendix is here:
    https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/pull/294

The goal is to give a hash_to_ristretto255 function that is a drop-in
replacement for the hash_to_curve function, in the sense that it
gives the same API, the same security properties, and the same
domain separation strategy. This should make it easy for protocols
using a hash-to-curve function to migrate to ristretto255.

(Note that hash_to_ristretto255 *does not* aim to return group elements
with any particular relationship to the ones returned by hash_to_curve
functions targeting curve25519 or edwards25519, as this would seemingly
violate the ristretto255 abstraction.)

In more detail: the ristretto255 draft specifies a FROM_UNIFORM_BYTES
function that, on input a uniformly random 64-byte string, outputs
a random ristretto255 element. The hash_to_ristretto function simply
composes FROM_UNIFORM_BYTES with the same hashing primitives used
in the hash_to_curve function.

Your feedback, by email or on GitHub, would be very much appreciated!

Best regards,

-=rsw

---

From: "Filippo Valsorda" <[email-masked]>
Date: Thu, 13 Aug 2020 02:04:00 -0400

> Your feedback, by email or on GitHub, would be very much appreciated!

Hello Riad,

Thank you for working on this!

Speaking for myself, this looks great judging from a quick skim, and I
think it's a clean way to compose the h2c API and the r255 one.

One quick note, the latest version of the ristretto255 draft did away
with the eyesore FROM_UNIFORM_BYTES naming and just calls that function
the one-way map.

https://ietf.org/id/draft-irtf-cfrg-ristretto255-00.html#name-one-way-map

Cheers,
Filippo

> Best regards,
> 
> -=rsw
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>