Subject: Re: [Cfrg] I-D Action: draft-irtf-cfrg-hash-to-curve-04.txt

From: Armando Faz <[email-masked]>
Date: Mon, 22 Jul 2019 11:40:19 -0700

Revisiting Ulas' paper [1], the Theorem 2.3 proposes two methods:
 - one for Weierstrass curves of the form: y^2 = x^n+ax+b, which includes
almost all elliptic curves except those with a=0 or b=0.
 - and another one for curves of the form: y^2=x^n+ax^2+bx, which includes
Montgomery curves except those with a=0 or b=0.

Although there exist faster methods for hashing (e.g. the simplified SWU,
Icart's, and Elligator2), the SWU method has the advantage of supporting
more curves at the cost of evaluating several expensive operations.

Example 1: Hashing methods for P-256 curve: simplified SWU and SWU.
Example 2: Hashing methods for Curve448: Elligator2 and SWU.

Hence, SWU can be used as a last resort in case one of the faster methods
can not be applied.

[1] Ulas, Rational Points on Certain Hyperelliptic Curves over Finite
Fields.

-- 
Armando Faz
Cloudflare Inc.

---

From: Rene Struik <[email-masked]>
Date: Mon, 22 Jul 2019 14:53:32 -0400

Hi Armando:

Thanks for your note. Curve448 is defined over a field GF(q) with q=3 
(mod 4), so it seems the simplified SWU mapping, as well as "Elligator2" 
(which can be viewed as a "repackaged" version of simplified SWU for 
Montgomery curves) both apply.

Rene

On 7/22/2019 2:40 PM, Armando Faz wrote:
>  - one for Weierstrass curves of the form: y^2 = x^n+ax+b, which 
> includes almost all elliptic curves except those with a=0 or b=0.
>  - and another one for curves of the form: y^2=x^n+ax^2+bx, which 
> includes Montgomery curves except those with a=0 or b=0.
>
> Although there exist faster methods for hashing (e.g. the simplified 
> SWU, Icart's, and Elligator2), the SWU method has the advantage of 
> supporting more curves at the cost of evaluating several expensive 
> operations.
>
> Hence, SWU can be used as a last resort in case one of the faster 
> methods can not be applied.
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363