Skip to main content

Hashing to Elliptic Curves
draft-irtf-cfrg-hash-to-curve-16

Revision differences

Document history

Date Rev. By Action
2023-02-09
16 (System) RFC Editor state changed to RFC-EDITOR from EDIT
2022-10-20
16 (System) RFC Editor state changed to EDIT from MISSREF
2022-10-03
16 (System) RFC Editor state changed to MISSREF
2022-10-03
16 (System) IANA Action state changed to No IANA Actions from In Progress
2022-10-03
16 (System) IANA Action state changed to In Progress
2022-10-02
16 Colin Perkins IRTF state changed to Sent to the RFC Editor from In IESG Review
2022-10-02
16 Colin Perkins Sent request for publication to the RFC Editor
2022-06-27
16 Amanda Baber IANA Review state changed to IANA OK - No Actions Needed
2022-06-27
16 Amanda Baber
(Via drafts-eval@iana.org): IESG/Authors/ISE:

The IANA Functions Operator has reviewed draft-irtf-cfrg-hash-to-curve-16 and has the following comments:

We understand that this document doesn't require any registry …
(Via drafts-eval@iana.org): IESG/Authors/ISE:

The IANA Functions Operator has reviewed draft-irtf-cfrg-hash-to-curve-16 and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

Thank you,

Amanda Baber
IANA Operations Manager
2022-06-23
16 Colin Perkins IRTF state changed to In IESG Review from In IRSG Poll
2022-06-23
16 Colin Perkins IETF conflict review initiated - see conflict-review-irtf-cfrg-hash-to-curve
2022-06-15
16 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-16.txt
2022-06-15
16 Christopher Wood New version accepted (logged-in submitter: Christopher Wood)
2022-06-15
16 Christopher Wood Uploaded new revision
2022-06-15
15 (System) Revised ID Needed tag cleared
2022-06-15
15 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-15.txt
2022-06-15
15 Christopher Wood New version accepted (logged-in submitter: Christopher Wood)
2022-06-15
15 Christopher Wood Uploaded new revision
2022-05-30
14 Colin Perkins
IRSG poll has closed with enough positions to proceed. Spencer had comments. Please review and discuss, and submit an updated draft if needed, then this …
IRSG poll has closed with enough positions to proceed. Spencer had comments. Please review and discuss, and submit an updated draft if needed, then this can go for IESG conflict review.
2022-05-30
14 Colin Perkins Tag Revised I-D Needed set.
2022-05-30
14 Colin Perkins Closed "IRSG Approve" ballot
2022-05-12
14 Spencer Dawkins
[Ballot comment]
I'm only vaguely aware of how this stuff works, so please keep that in mind, when reading my comments. I hope they are …
[Ballot comment]
I'm only vaguely aware of how this stuff works, so please keep that in mind, when reading my comments. I hope they are somewhat helpful.

In this text from the Introduction,

Unfortunately for implementors, the precise hash function that is suitable for a given protocol implemented using a given elliptic curve is often unclear from the protocol's description. Meanwhile, an incorrect choice of hash function can have disastrous consequences for security.

I’m not sure I understand (at this point in the document) what the problem is (“why it’s not OK to just pick a hash function”), other than “if you do that, bad things will happen”). Is there a reference you could include here, or even a forward pointer if there's a good place to point to in the draft, so that us non-experts can follow along?

I learned a lot from googling “rejection sampling methods” while reading this text

This document does not cover rejection sampling methods, sometimes referred to as "try-and-increment" or "hunt-and-peck,"

But the text didn’t tell me enough to understand rejection sampling methods. Perhaps a half-sentence explanation, or a reference, would be helpful.

This is nit-ish, but it confused me.

5.1.  Security considerations, is only for section 5, is that right? There’s another Security Considerations - section 10 - which starts with these two sentences:

Section 3.1 describes considerations related to domain separation. See Section 10.4 for further discussion.

Section 5 describes considerations for uniformly hashing to field elements; see Section 10.2 and Section 10.3 for further discussion.

I found myself wondering why some security considerations seem to be in Section 3.1 (which isn’t called Security considerations), and others seem to be in Section 5 (shouldn’t the second sentence refer to Section 5.1, which IS called Security considerations?), and these considerations outside Section 10 aren’t complete. If I was looking for all the Security considerations, I’d expect to find them together, and probably in Section 10.

Do the right thing, of course.

I’m not picking on BCP 14 language in most of the text, but in Section 7,

Note that in this case scalar multiplication by the cofactor h does not generally give the same result as the fast method, and SHOULD NOT be used.

I’m not understanding why this is not a MUST - when is it OK to use scalar multiplication, if it usually gives a different result?

I have roughly the same question in Section 8.5,

This section defines ciphersuites for curve25519 and edwards25519 [RFC7748]. Note that these ciphersuites SHOULD NOT be used when hashing to ristretto255 [I-D.irtf-cfrg-ristretto255-decaf448]. See Appendix B for information on how to hash to that group.

What if I DO use these ciphersuites inappropriately?

Very similar text is in 8.6, so I have a very similar question.

This section defines ciphersuites for curve448 and edwards448 [RFC7748]. Note that these ciphersuites SHOULD NOT be used when hashing to decaf448 [I-D.irtf-cfrg-ristretto255-decaf448]. See Appendix C for information on how to hash to that group.

Do the right thing, of course.

In section 8.9,

The RECOMMENDED way to define a new hash-to-curve suite is:



When hashing to an elliptic curve not listed in this section, corresponding hash-to-curve suites SHOULD be fully specified as described above.

As a nit, “not listed in this section” might reasonably be read as “not listed in section 8.9”. I think you might better say “not listed elsewhere in section 8”.

But beyond that, I don’t think you mean “RECOMMENDED” in the BCP 14 sense. If this text said

For elliptic curves not listed elsewhere in section 8, a new hash-to-curve suite can be defined by


You wouldn’t need any of the BCP 14 language in this section, with the attendant “why is this not a MUST”, “in what cases would you not do this”, and “if you don’t do this, what happens?” questions that reviewers can’t help asking …
2022-05-12
14 Spencer Dawkins [Ballot Position Update] New position, No Objection, has been recorded for Spencer Dawkins
2022-05-10
14 Melinda Shore [Ballot Position Update] New position, Yes, has been recorded for Melinda Shore
2022-05-10
14 Mat Ford [Ballot Position Update] New position, No Objection, has been recorded for Mat Ford
2022-05-10
14 David Oran [Ballot Position Update] New position, No Objection, has been recorded for David Oran
2022-05-10
14 Christopher Wood [Ballot Position Update] Position for Christopher Wood has been changed to Recuse from Yes
2022-05-10
14 Brian Trammell [Ballot Position Update] New position, No Objection, has been recorded for Brian Trammell
2022-05-10
14 Christopher Wood [Ballot Position Update] New position, Yes, has been recorded for Christopher Wood
2022-05-10
14 Colin Perkins [Ballot Position Update] New position, Yes, has been recorded for Colin Perkins
2022-05-10
14 Colin Perkins IRTF state changed to In IRSG Poll from IRSG Review
2022-05-10
14 Colin Perkins Created IRSG Ballot
2022-05-10
14 Colin Perkins Melinda Shore reviewed for IRSG
2022-05-10
14 Colin Perkins IRTF state changed to IRSG Review from Awaiting IRSG Reviews
2022-03-07
14 Colin Perkins IRTF state changed to Awaiting IRSG Reviews from Waiting for IRTF Chair
2022-02-18
14 (System) Revised ID Needed tag cleared
2022-02-18
14 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-14.txt
2022-02-18
14 (System) New version accepted (logged-in submitter: Christopher Wood)
2022-02-18
14 Christopher Wood Uploaded new revision
2022-02-14
13 Colin Perkins
I sent IRTF Chair review comments to the list. I expect a minor update is needed to address these, but am willing to hear arguments …
I sent IRTF Chair review comments to the list. I expect a minor update is needed to address these, but am willing to hear arguments otherwise.
2022-02-14
13 Colin Perkins Tag Revised I-D Needed set.
2021-11-10
13 Stanislav Smyshlyaev IRTF state changed to Waiting for IRTF Chair from Waiting for Document Shepherd
2021-11-10
13 Stanislav Smyshlyaev
Technical Summary
This document describes a set of procedures for encoding an arbitrary-length byte string to a point on an elliptic curve. The document contains …
Technical Summary
This document describes a set of procedures for encoding an arbitrary-length byte string to a point on an elliptic curve. The document contains a set of recommended suites, provides implementation guidelines and target security levels for each of them. Rejection sampling methods of hashing to curves are not covered by the document because of significant issues with constant-time implementations.
This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Research Group Summary
After adopting the document it was presented in CFRG meetings at IETF 101, IETF 102, IETF 103, IETF 105 and IETF 106.
There was a Research Group Last Call for the draft in 2020. There were no major concerns raised during the RGLC. Several minor concerns raised during the RGLC were addressed by the authors.
The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered.
Crypto Review Panel review was solicited in June 2020. The review was provided by Thomas Pornin. Comments from that review were addressed in -09 and -10.

Document Quality
There are at least eight implementations for various elliptic curves: a Go implementation (in CIRCL) for hashing to curve for the three NIST curves[1] and for BLS12-381 [2], implementations for BLS12-381 in rust [3], boringSSL [4], wrapper Go-rust-C [5] , and py_ecc [6], EIP for ethereum [7,8], see also [9].
All authors of the document have confirmed that they are not aware of any IPRs related to the document other than the ones that are already in the datatracker.
The construction is used in a significant number of CFRG documents (active CFRG I-Ds for the current moment): Two-Round Threshold Signatures with FROST, SPAKE2, Oblivious Pseudorandom Functions (OPRFs) using Prime-Order Groups, Verifiable Random Functions (VRFs), Pairing-Friendly Curves.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Colin Perkins is the IRTF Chair.

[1] https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/pull/326
[2] https://github.com/cloudflare/circl/blob/master/ecc/bls12381/g1.go#L357
[3] https://github.com/zkcrypto/bls12_381/tree/main/src/hash_to_curve
[4] https://boringssl.googlesource.com/boringssl/+/refs/heads/master/crypto/ec_extra/hash_to_curve.c
[5] https://github.com/drand/bls12381rs
[6] https://github.com/ethereum/py_ecc/blob/master/py_ecc/bls/hash_to_curve.py
[7] https://github.com/ethereum/EIPs/blob/master/EIPS/eip-3068.md
[8] https://github.com/ethereum/EIPs/blob/master/EIPS/eip-2537.md
[9] https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve#reference-implementations
2021-11-10
13 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-13.txt
2021-11-10
13 (System) New version accepted (logged-in submitter: Christopher Wood)
2021-11-10
13 Christopher Wood Uploaded new revision
2021-09-16
12 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-12.txt
2021-09-16
12 (System) New version accepted (logged-in submitter: Christopher Wood)
2021-09-16
12 Christopher Wood Uploaded new revision
2021-04-13
11 Riad Wahby New version available: draft-irtf-cfrg-hash-to-curve-11.txt
2021-04-13
11 (System) New version accepted (logged-in submitter: Riad Wahby)
2021-04-13
11 Riad Wahby Uploaded new revision
2021-02-18
10 Alexey Melnikov IRTF state changed to Waiting for Document Shepherd from In RG Last Call
2020-12-22
10 Stanislav Smyshlyaev Notification list changed to smyshsv@gmail.com because the document shepherd was set
2020-12-22
10 Stanislav Smyshlyaev Document shepherd changed to Stanislav V. Smyshlyaev
2020-10-27
10 Stanislav Smyshlyaev In RGLC from October 17th till November, 1st, 2020.
2020-10-27
10 Stanislav Smyshlyaev IRTF state changed to In RG Last Call from Active RG Document
2020-10-11
10 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-10.txt
2020-10-11
10 (System) New version accepted (logged-in submitter: Christopher Wood)
2020-10-11
10 Christopher Wood Uploaded new revision
2020-08-04
09 Alexey Melnikov Intended Status changed to Informational from None
2020-08-04
09 Alexey Melnikov Changed consensus to Yes from Unknown
2020-06-29
09 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-09.txt
2020-06-29
09 (System) New version accepted (logged-in submitter: Christopher Wood)
2020-06-29
09 Christopher Wood Uploaded new revision
2020-06-01
08 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-08.txt
2020-06-01
08 (System) New version accepted (logged-in submitter: Christopher Wood)
2020-06-01
08 Christopher Wood Uploaded new revision
2020-04-27
07 Nick Sullivan New version available: draft-irtf-cfrg-hash-to-curve-07.txt
2020-04-27
07 (System) New version approved
2020-04-27
07 (System)
Request for posting confirmation emailed to previous authors: Riad Wahby , Armando Faz-Hernandez , Christopher Wood , Nick Sullivan , cfrg-chairs@ietf.org, Sam Scott , …
Request for posting confirmation emailed to previous authors: Riad Wahby , Armando Faz-Hernandez , Christopher Wood , Nick Sullivan , cfrg-chairs@ietf.org, Sam Scott , irtf-chair@irtf.org
2020-04-27
07 Nick Sullivan Uploaded new revision
2020-03-09
06 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-06.txt
2020-03-09
06 (System) New version accepted (logged-in submitter: Christopher Wood)
2020-03-09
06 Christopher Wood Uploaded new revision
2019-11-08
05 Alexey Melnikov Added to session: IETF-106: cfrg  Wed-1330
2019-11-02
05 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-05.txt
2019-11-02
05 (System) New version accepted (logged-in submitter: Christopher Wood)
2019-11-02
05 Christopher Wood Uploaded new revision
2019-10-29
Jenny Bui Posted related IPR disclosure: Riad S. Wahby's Statement about IPR related to draft-irtf-cfrg-hash-to-curve belonging to Idemia Identity and Security France SAS
2019-10-29
Jenny Bui Posted related IPR disclosure: Riad S. Wahby's Statement about IPR related to draft-irtf-cfrg-hash-to-curve belonging to Idemia Identity and Security France SAS
2019-10-29
Jenny Bui Posted related IPR disclosure: Riad S. Wahby's Statement about IPR related to draft-irtf-cfrg-hash-to-curve belonging to Idemia Identity and Security France SAS
2019-10-16
Jenny Bui Posted related IPR disclosure: Riad S. Wahby's Statement about IPR related to draft-irtf-cfrg-hash-to-curve belonging to Idemia Identity and Security France SAS
2019-10-16
Jenny Bui Posted related IPR disclosure: Riad S. Wahby's Statement about IPR related to draft-irtf-cfrg-hash-to-curve belonging to Idemia Identity and Security France SAS
2019-10-16
Jenny Bui Posted related IPR disclosure: Riad S. Wahby's Statement about IPR related to draft-irtf-cfrg-hash-to-curve belonging to Idemia Identity and Security France SAS
2019-07-08
04 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-04.txt
2019-07-08
04 (System) New version approved
2019-07-08
04 (System) Request for posting confirmation emailed to previous authors: Sam Scott , Christopher Wood , irtf-chair@irtf.org, cfrg-chairs@ietf.org, Nick Sullivan
2019-07-08
04 Christopher Wood Uploaded new revision
2019-03-11
03 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-03.txt
2019-03-11
03 (System) New version approved
2019-03-11
03 (System) Request for posting confirmation emailed to previous authors: Sam Scott , Christopher Wood , Nick Sullivan
2019-03-11
03 Christopher Wood Uploaded new revision
2018-11-03
02 Alexey Melnikov Added to session: IETF-103: cfrg  Mon-1120
2018-10-22
02 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-02.txt
2018-10-22
02 (System) New version approved
2018-10-22
02 (System) Request for posting confirmation emailed to previous authors: Sam Scott , Christopher Wood , Nick Sullivan
2018-10-22
02 Christopher Wood Uploaded new revision
2018-07-11
01 Alexey Melnikov Added to session: IETF-102: cfrg  Tue-1550
2018-07-02
01 Nick Sullivan New version available: draft-irtf-cfrg-hash-to-curve-01.txt
2018-07-02
01 (System) New version approved
2018-07-02
01 (System) Request for posting confirmation emailed to previous authors: Christopher Wood , irtf-chair@irtf.org, cfrg-chairs@ietf.org, Nick Sullivan
2018-07-02
01 Nick Sullivan Uploaded new revision
2018-04-08
00 Alexey Melnikov IRTF state changed to Active RG Document
2018-04-08
00 Alexey Melnikov This document now replaces draft-sullivan-cfrg-hash-to-curve instead of None
2018-03-23
00 Christopher Wood New version available: draft-irtf-cfrg-hash-to-curve-00.txt
2018-03-23
00 (System) WG -00 approved
2018-03-23
00 Christopher Wood Set submitter to ""Christopher A. Wood" ", replaces to (none) and sent approval email to group chairs: cfrg-chairs@ietf.org
2018-03-23
00 Christopher Wood Uploaded new revision