# Tag Info

You will need a quadratic non-residue in order to decompress the points, and there is no known deterministic algorithm that will provably find one efficiently. Also, if you allow both sign bits for $\: y=0 \:$ or the point-at-infinity, then you will lose non-malleability and strong unforgeability.