Closed paulmillr closed 4 years ago
They are less computationally expensive, since they only require one evaluation of the mapping rather than two for -RO.
Indeed -- and we have a number of protocols identified that need them. (This came up in the context of #235.) See this page for more details: https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/wiki/Known-applications.
It's unclear what's the benefit of NU encoding. The spec says "you should use random oracle encoding when possible". Why use NU at all? Perhaps someone could answer the q here, or clarify this in the spec...