Why include nonuniform encodings at all?

cfrg / draft-irtf-cfrg-hash-to-curve

Hashing to Elliptic Curves

Other

79 stars 27 forks source link

Why include nonuniform encodings at all? #260

Closed paulmillr closed 4 years ago

paulmillr commented 4 years ago

It's unclear what's the benefit of NU encoding. The spec says "you should use random oracle encoding when possible". Why use NU at all? Perhaps someone could answer the q here, or clarify this in the spec...

kwantam commented 4 years ago

They are less computationally expensive, since they only require one evaluation of the mapping rather than two for -RO.

chris-wood commented 4 years ago

Indeed -- and we have a number of protocols identified that need them. (This came up in the context of #235.) See this page for more details: https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/wiki/Known-applications.