Open autquis opened 7 months ago
Is the option to squeeze a group element actually used anywhere? I have never seen a protocol rely on this.
I agree with the option to absorb with a domain separator.
I think for our use case it's enough to be able to absorb group elements.
Regarding
CryptographicSponge
(andAbsorb
):Currently, the sponge does not have a method for absorbing with a domain separator (or label; I am not sure what the correct term is). I think it would be better to have two methods; one absorbs without a label, and the other absorbs with a label included.
To absorb group elements, one has to implement
Absorb
for the group. It would be nicer if we have the implementation ofAbsorb
for all groups (by probably only serializing them). Furthermore, it is only possible to squeeze bits, bytes, and field elements (slow), so, to squeeze a group element, one has to squeeze bytes and then map to a group element.