kwantam / bls12-381_hash Goto Github PK

This issue is likely a question for ideas.

Hashing to curves (in constant-time) is sufficient for many applications. Yet, some applications want more---when one does rerandomizable encryption (e.g., for mix-net), the person needs a way to embed data to points on the curve and, more importantly, recover the data back.

Aka, an injective encoding, in constant time.

A use case is in Metal (https://eprint.iacr.org/2020/083) where an injective encoding for the Risttetto group is used for rerandomizable encryption (implemented here: https://github.com/oblivious-file-sharing/libristretto-elgamal). Sadly, Risttetto is not pairing-friendly, which may not be suitable for applications that need this property on the curves.

Thus, it is unknown whether for BLS-381 we can have something similar---a hashing to curve with an efficient inverse map. If we can use elligators it would be easy, but BLS12-381 seems to dislike elligators.