I have a minor question from the talk related to the hiding encoding of a point.
-
PURB uses Kyber v2, which samples the public key in the prime-order group (i.e., clearing the cofactor h = 8), instead of any random point on Curve25519.
https://github.com/dedis/kyber/blob/v2/group/curve25519/curve.go#L84
-
The type-2 elligator converts any point on Curve25519 to a number in F_q.
I wonder if one could distinguish PURB's encryption traffic, by leveraging the insight that all the decoding of Hiding(g^x) would be a point in that prime-order subgroup, which happens only at a chance of 1/8.
There are a few ways to fix it though. First, it seems that CDH suffices so it does not need to be in the prime-order group. Second, one could sample a random point on Curve25519 and perform a hiding encoding on it, while the recipient is the one in charge of removing the cofactor after decoding. Third, curves with cofactor h = 1, though much less efficient, are always an option, e.g., BN curves, and they have some forms of elligators as well.
I have a minor question from the talk related to the hiding encoding of a point.
PURB uses Kyber v2, which samples the public key in the prime-order group (i.e., clearing the cofactor h = 8), instead of any random point on Curve25519.
https://github.com/dedis/kyber/blob/v2/group/curve25519/curve.go#L84
The type-2 elligator converts any point on Curve25519 to a number in F_q.
I wonder if one could distinguish PURB's encryption traffic, by leveraging the insight that all the decoding of Hiding(g^x) would be a point in that prime-order subgroup, which happens only at a chance of 1/8.
There are a few ways to fix it though. First, it seems that CDH suffices so it does not need to be in the prime-order group. Second, one could sample a random point on Curve25519 and perform a hiding encoding on it, while the recipient is the one in charge of removing the cofactor after decoding. Third, curves with cofactor h = 1, though much less efficient, are always an option, e.g., BN curves, and they have some forms of elligators as well.