Subject: [Cfrg] Comments on draft-irtf-cfrg-hash-to-curve

From: Marek Jankowski <[email-masked]>
Date: Mon, 30 Jul 2018 06:59:05 -0700

Dear Scott, Sullivan and Wood,

I have a few minor comments with regard to the hashing to curves draft.

In Section 2, page 2, the name Weierstrauss should be spelled Weierstrass.

Quite importantly, and also in Section 2, for a group of size n to have a
subgroup of size q, the relation n = qh should hold with no remainder.

In Section 2.1.1, is E usually defined over GF(p^k) with p > 2? Koblitz has
constructed binary elliptic curves (N. Koblitz, "CM-curves with good
cryptographic properties", Advances in Cryptology - CRYPTO '91, pp.
279-287). In any case, it appears that the question of whether or not p = 2
is irrelevant to the current paragraph, as even in such a case, the size of
the curve would not necessarily be 2^k.

In section 3, the relation between the two tables was not very clear to me
on first reading. Perhaps the paragraph stating "To find the suitable
algorithm..." should be clarified?

In section 5.2.1, in the description of the method Icart at the top of page
7, why was the variable v not assigned like the rest of the variables?

In sections 5.2.2 and 5.2.3, because the square root of an element in
GF(p^k) is not unique (unless p = 2), it would probably be better to
require the use of a deterministic square root algorithm.

Thank you,
Marek.