search

fcelda / nsec5-draft

Working Copy of the NSEC5 Specification
15 stars 2 forks source link

vrf hash_to_curve won't end up in G when cofactor > 1 #16

Closed reyzin closed 7 years ago

reyzin commented 7 years ago

The curve may have more points than q, in which case G is not the whole curve, but only a subgroup of it. This is not the case for the NIST prime-field curves, but is for some other curves (e.g., 25519, NIST binary-field curves). ECVRF_hash_to_curve will not work in that case, because it will get a point on the curve, but not in the group G. Multiplying by the cofactor should solve the problem.

goldbe commented 7 years ago

Also, see https://github.com/fcelda/nsec5-draft/commit/f277c06f26ec579dcaaf480700b7bd56f3d75ce8 which modifies the way we do ECVRF_proof2hash to make sure that an EC point gamma (which is not necessarily in G) is mapped to G by raising it to the cofactor.

goldbe commented 7 years ago

I think we can close this now. Note however that the change does require some implementations to be updated. We should update the implementers.