From the main page;
Ristretto is a technique for constructing prime order elliptic curve groups with non-malleable encodings. It extends Mike Hamburg's Decaf approach to cofactor elimination to support cofactor-8 curves such as Curve25519.
The cofactor can cause some problems in some protocols, MQV, HMQV, MVQ and HMVQ
The main idea is the coset definition, only Edwards here;
Edward Curve ( twisted Edward Curve if $a\neq 1$ and untwisted Edward Curve if $a=1$)
$$\mathcal{E}_{a,d} := \{(x, y) \in \mathbb{P}^2 (\mathbb{F}) : a \cdot x^2 + y^2 = 1 + d \cdot x^2 \cdot y^2\}$$
has a cofactor of 4. A complete ( if $d$ and $ad$ are nonsquare in $\mathbb{F}$) Edward curve $\mathcal{E}_{a,d}$ has a $4$-torsion group ( elements of order $4$) and it turns out that it has exactly has 4 elements. Then the below coset is defined w.r.t. $P=(x,y)$
$$\mathcal{E}[4] + P = \{(x, y); (y/ \sqrt a, −x \sqrt a); (−x, −y); (−y/ \sqrt a, x \sqrt a)\}$$
Now, this coset eliminates the co-factor problem. Similar definitions for Jacobi with isogenies are given. Also for the compatibility of the Montgomery curves.
In The Ristretto Group, do all points sampled with Elligator have the same order?
This coset operation makes sure that the order (number of elements) of the coset curve is prime. Since the order of the group is prime then by the Lagrange theorem all elements have prime order ( order of elements must divide the order of the group).
In short, now, the hash-to-group with Elligator maps the hash into elements where each has prime order, except the identity.
Does any basepoint create a weakness?
The answer is no!. Consider that an attacker chooses the base $G$ deliberately that they can solve it easily. There is a simple approach for them to solve for any basis $G'$;
- Solve DLog $G'$ to base $G$ to obtain $G' = [k]G$.
- Now given $[x]G'$ solve it in the base $G$ to obtain $r$ such that $[x]G'=[r]G$
- To get the $x$ just compute $x = r\cdot k^{-1} \pmod n$ where $n$ is the group order.