Paper 2021/1082

Some remarks on how to hash faster onto elliptic curves

Dmitrii Koshelev
Abstract

In this article we propose three optimizations of indifferentiable hashing onto (prime order subgroups of) ordinary elliptic curves over finite fields $\mathbb{F}_{\!q}$. One of them is dedicated to elliptic curves $E$ provided that $q \equiv 2 \ (\mathrm{mod} \ 3)$. The other two optimizations take place respectively for the subgroups $\mathbb{G}_1$, $\mathbb{G}_2$ of some pairing-friendly curves. The performance gain comes from the smaller number of required exponentiations in $\mathbb{F}_{\!q}$ for hashing to $E(\mathbb{F}_{\!q})$, $\mathbb{G}_2$ (resp. from the absence of necessity to hash directly onto $\mathbb{G}_1$). In particular, our results affect the pairing-friendly curve BLS12-381 (the most popular in practice at the moment) as well as a few ones from the international draft NIST SP 800-186. Among other things, we present a taxonomy of state-of-the-art hash functions to elliptic curves.

Metadata
Available format(s)
PDF
Category
Implementation
Publication info
Preprint.
Keywords
BLS12 family of pairing-friendly curves clearing cofactor indifferentiable hashing to elliptic curves optimal ate pairings
Contact author(s)
dimitri koshelev @ gmail com
History
2022-07-07: last of 8 revisions
2021-08-25: received
See all versions
Short URL
https://ia.cr/2021/1082
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2021/1082,
      author = {Dmitrii Koshelev},
      title = {Some remarks on how to hash faster onto elliptic curves},
      howpublished = {Cryptology ePrint Archive, Paper 2021/1082},
      year = {2021},
      note = {\url{https://eprint.iacr.org/2021/1082}},
      url = {https://eprint.iacr.org/2021/1082}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.