why not use hkdf instead of expand_message

cfrg / draft-irtf-cfrg-hash-to-curve

Hashing to Elliptic Curves

Other

79 stars 27 forks source link

why not use hkdf instead of expand_message #335

Closed stef closed 2 years ago

stef commented 2 years ago

i found this https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/issues/137 previous issue, and i'm confused was it already used for the expand message part, or was this something else?

kwantam commented 2 years ago

Thanks for the question! (FYI, we discussed this in #202.) The high-level summary is:

efficiency on embedded systems, and
paranoia about domain separation of the underlying hash functions.

Note that it may be possible to specify expand_message in terms of HKDF (though it would require some assumptions and/or care for domain separation) and, once that's done, build a suite on top of it.

stef commented 2 years ago

aah. thank you i did look for hkdf while searching the issues, but this issue i missed. my question is answered!