Indifferentiable Hashing to Barreto–Naehrig Curves

Pierre-Alain Fouque (1, 2) , Mehdi Tibouchi (3)

1 IRISA - Institut de Recherche en Informatique et Systèmes Aléatoires
2 UR - Université de Rennes
3 NTT Communication Science Laboratories

A number of recent works have considered the problem of constructing constant-time hash functions to various families of elliptic curves over finite fields. In the relevant literature, it has been occasionally asserted that constant-time hashing to certain special elliptic curves, in particular so-called BN elliptic curves, was an open problem. It turns out, however, that a suitably general encoding function was constructed by Shallue and van de Woestijne back in 2006. In this paper, we show that, by specializing the construction of Shallue and van de Woestijne to BN curves, one obtains an encoding function that can be implemented rather efficiently and securely, that reaches about 9/16ths of all points on the curve, and that is well-distributed in the sense of Farashahi et al., so that one can easily build from it a hash function that is indifferentiable from a random oracle.

Mots clés: Elliptic curve cryptography; BN curves; hashing; random oracle

Domaines: Cryptographie et sécurité [cs.CR]

Pierre-Alain Fouque, Mehdi Tibouchi. Indifferentiable Hashing to Barreto–Naehrig Curves. Progress in Cryptology - {LATINCRYPT} 2012, Oct 2012, Santiago, Chile. pp.17, ⟨10.1007/978-3-642-33481-8_1⟩. ⟨hal-01094321⟩