Hash to scalar about blst

[dot-asm]

The project's prime objective is to comply with the specific specifications, hash-to-curve and bls-signature. This doesn't mean that everything else is off the table, but it means that anything extra is expected to raise above mere proclamation of a possibility. In other words, is there a specification, application or proposed draft?

[iancoleman]

Not sure that hash to scalar will be formalized in a spec, definitely doesn't look to be soon, so I'll close this issue for now.

The only thing I could find close to a spec is zkcrypto/bls12_381/hash_to_curve/scalar #L20 but this is behind the 'experimental' feature flag so seems some way off being suited for inclusion in blst.

[dot-asm]

Hmmm... Latest hash-to-curve draft added separate test vectors for expand_message_xmd. This effectively puts pressure on blst to export expand_message_xmd. And if it is exported, then you can combine it with blst_scalar_from_be_bytes to hash to scalar, right?

[iancoleman]

I would be happy to see expand_message_xmd exported. This would enable the functionality I'm looking for without explicitly labeling it, but I guess it goes against keeping the api surface small. Seeing that you're looking to macro-ify the api maybe later if hash-to-scalar becomes more explicit then it can be added.

[dot-asm]

There is blst_expand_message_xmd now. Along with expand_message_xmd_SHA256_*.json test vectors. As for bindings, it's available only in Go as private interface for the moment. I reckon it's lesser point to make it public, it's arguably more appropriate to provide a HashTo method. And then make similar arrangements in other cases. Yeah, it contradicts the original assertion that it should raise above mere possibility, but it wasn't isn't actually [a] black-n-white issue. Since blst_expand_message_xmd "barrier" is passed to accommodate dedicated test vectors, there is no reason to be overly rigid about its possible application.

BTW, what's your target language?

[iancoleman]

I'm targeting rust.

I'm working on a fusion of threshold_crypto with blst, progress is in blsttc.

Originally blst was used for cross-compatibility of signatures with zcash chia etc (threshold_crypto used a different hash_g2 based on randchacha). Also for improved performance. But lately I've been working towards replacing bls12_381 crate with blst for Fr, G1, G2 (in this branch, still very WIP).

I want to replace this repeated hashing with hash to scalar.

[dot-asm]

I'm targeting rust.

Now build/refresh.sh is executed. Thanks for the links!