elliptic-curve: hash-to-curve support

[kevinlewi]

It would be nice to have support for a from_uniform_bytes functionality for the elliptic curve implementations that performs the hash-to-curve operations described here, preferably the _SSWU_RO_ variants!

[burdges]

I'd expect some churn coming based upon https://mailarchive.ietf.org/arch/msg/cfrg/ZYlKNd4JJiJxNTYSwrY-ZFb4LeI/

[tarcieri]

I think we can potentially work on some hash-to-curve traits while the spec is still in flux.

Note that there is a FromDigest trait, however I have some misgivings about it: it's presently used for hash-to-scalar for the purposes of ECDSA, and as much, I've thought about moving it to the ecdsa crate for the next release. Edit: removed in elliptic-curve v0.9, clearing the way for new hash-to-curve traits

[tarcieri]

Here's a library that implements draft-irtf-cfrg-hash-to-curve-11 and provides some traits: https://crates.io/crates/hash2field

It provides an example for using it with k256.

cc @mikelodder7

[mikelodder7]

I'm also working on crates for the optimized swu map and isogeny map if that helps. The idea is I've implemented hash2curve so many times and in no-std settings that the spec hasn't changed much in terms of code over time. Mostly just updating the information.

[newpavlov]

Continuation of this discussion: RustCrypto/elliptic-curves#432 (comment)

But I don't get how that works

D::OutputSize: IsEqual<U32> + IsEqual<U64> effectively says "OutputSize can be compared against U32 and U64", i.e. it's a constrain on "capability" which this type posses, not equality check itself. Same goes for Eq<D::OutputSize, U32>: BitOr<Eq<D::OutputSize, U64>>, it means "we can apply OR to the equality check results".

typenum is somewhat counter-intuitive, since you have to explicitly state a lot of "obvious" stuff.

I need to bound on support for a specific digest size

I am not sure I see a problem (though I can't say I 100% understand your snippet). SigningKey is based on Scalar, correct? So bounds of the latter will inevitably leak to bounds of the former. Can you explain what constraints you would like to express?