Subject: [CFRG] Call for additional comments on draft-irtf-cfrg-hash-to-curve

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Fri, 1 Oct 2021 21:49:11 +0300

Dear CFRG,

The authors of the "Hashing to Elliptic Curves" draft (
https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/) have
addressed all minor concerns raised after RGLC, so we are planning to move
it to the next stage really soon.

If you have any additional comments on the current (slightly updated)
version, please send them to the list.

Best regards,
Stanislav

---

From: "Gajcowski, Nicholas H" <[email-masked]>
Date: Tue, 26 Oct 2021 19:34:27 +0000

I wasn't able to go through all the draft as I hoped, but it does appear well written and in good shape.  I particularly appreciate the summary of related work given in Appendix A.   Just have a few minor comments.

Best,

Nick G.  

section 4.1 sgn0 function
   the definition is also dependent on how elements in the base/prime field are represented. 
   for example for the field GF(5), sgn0(-3) = -3 mod 2 = 1 = sgn0(3) which is not the desired effect 
   (but then sgn0(2) = 0).  maybe this could lead to u,y pairs whose signs disagree in a clumsy
   implementation that doesn't always represent prime field elements as non-negative ints.

section 5.3 hash_to_field function
  step 2 may fail as expand_message_xmd aborts when len_in_bytes exceeds a certain size
 
section 5.4.1 expand_message_xmd
  second paragraph recommends use of sha-2 and sha-3.  consider providing a table of input
  block sizes for these functions rather than mentioning the value for sha-512 and sha3-512
  in the subsequent paragraph

  the bound 255*b_in_bytes is checked in step 2 whereas the bound 2^16-1 is not checked

  unclear why there is a bound on len_in_bytes for expand_message_xmd but not for expand_message_xof

section 6.6.1 Shallue-van de Woestjine method
  step 6 multiplies tv4 by -1 if sgn(tv4)==1.  is this really necessary as the values -/+ tv5 are used
  in steps 9 and 10?