Subject: [Cfrg] On h2c implementation

From: Watson Ladd <[email-masked]>
Date: Fri, 6 Dec 2019 21:55:26 -0800

Dear all,

Recently one of my colleagues ran into some unexpected difficulties in
implementing the hash to curve draft. The underlying curve implementation
did not implement general purpose field arithmetic, but rather carried out
enough reduction at each step to be able to multiply a small number of
summands, and only at the end fully reduced.

This is a common way to avoid the cost of a full carry chain, but has the
disadvantage that the arithmetic functions need to be wrapped to properly
carry out comparisons to constants.

It may be worth calling this out in the document.

Sincerely,
Watson

---

From: "Riad S. Wahby" <[email-masked]>
Date: Sat, 07 Dec 2019 17:54:45 +0100

>carry out comparisons to constants.

Hello Watson,

Thanks for the feedback! We'll definitely give more thought to this issue. If you have any other details that you'd like to discuss off-list, happy to chat more.

Speaking only for myself (I haven't yet discussed with the other authors), my inclination is that details of field arithmetic implementations are quite a bit below the level of abstraction the hash-to-curve document is aiming for. For example, Section 4 currently says:

"Guidance on implementing these low-level operations in constant time is beyond the scope of this document."

(If I understand your email correctly, this isn't exactly what you're discussing, but it's in the ballpark and to me suggests a similar conclusion.)

Of course, I could be wrong and/or things could change! Again, happy to chat more.

Best,

-=rsw