<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">You can do this with Elligator, but to actually be indistinguishable you have to run it twice, add the results, and then convert to affine. This takes 3 inverses or square roots (maybe 2 if you’re really aggressive with the isqrt trick), which means that it’s not much faster than computing xG with a comb algorithm. On the plus side, it is entirely safe to use this as the basepoint for future DH operations, and those operations are essentially independent of each other and of xG. That’s what the SPEKE password-authenticated key exchange does.</div><div class=""><br class=""></div><div class="">— Mike</div><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 14, 2015, at 8:52 PM, Watson Ladd <<a href="mailto:watsonbladd@gmail.com" class="">watsonbladd@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" class=""><br class="">
On Sep 14, 2015 2:31 PM, "Jeff Burdges" <<a href="mailto:burdges@gnunet.org" class="">burdges@gnunet.org</a>> wrote:<br class="">
><br class="">
><br class="">
> I noticed a minor traffic whitenning issue in the HORNET paper : HORNET<br class="">
> uses Sphinx packets to build circuits through the mixnet, but the actual<br class="">
> HORNET packets that travel on those circuits use a different header.<br class="">
><br class="">
> This begs the question : How should I quickly generate a random curve<br class="">
> 25519 group element such that an observer cannot tell that I'm not<br class="">
> actually doing a scalar multiplication?<br class="">
><br class="">
> We want a hash function f that yields a curve25519 group element such<br class="">
> that :<br class="">
> (a) if X,Y have uniform distributions, then the resulting distribution<br class="">
> f(X) is (sufficiently?) indistinguishable from g(Y) * G where g is some<br class="">
> reasonable hash function that yield curve25519 scalars and G is a base<br class="">
> point.<br class="">
> (b) f(x) can be computed an order of magnitude faster than g(x) * G. I<br class="">
> hear a curve25519 DH operation takes about 40x longer than a typical<br class="">
> sha512 based KDF.</p><p dir="ltr" class="">What about Elligator encoding everything?<br class="">
><br class="">
> Also, is it possible to do this is such a way that f(x) is a safe<br class="">
> basepoint for future DH operations?<br class="">
><br class="">
> Jeff<br class="">
><br class="">
><br class="">
><br class="">
> _______________________________________________<br class="">
> Curves mailing list<br class="">
> <a href="mailto:Curves@moderncrypto.org" class="">Curves@moderncrypto.org</a><br class="">
> <a href="https://moderncrypto.org/mailman/listinfo/curves" class="">https://moderncrypto.org/mailman/listinfo/curves</a><br class="">
><br class="">
</p>
_______________________________________________<br class="">Curves mailing list<br class=""><a href="mailto:Curves@moderncrypto.org" class="">Curves@moderncrypto.org</a><br class="">https://moderncrypto.org/mailman/listinfo/curves<br class=""></div></blockquote></div><br class=""></body></html>