How are signature operations like hashing or concatenating with a message done when the input is an elliptic curve point?

Question

For a Message M, Schnorr Signature steps are

1. Use a scalar $p$ as private key
2. Public key $P = pG$ where G is the generator of an Elliptic Curve
3. Generate random number $q$ & compute $Q = qG$
4. $c = Hash(Q || M)$
5. $s = c * p + q\mod\ell$ where $\ell$ is the group order

$(Q,s)$ is the Schnorr Signature

• How does one concatenate $Q||M$ when $Q$ is an elliptic curve point? What is the output type? Can it be directly used as input for a standard hash function like SHA256?

Are there standard ways to do this?

Answer 1

The standard ways to encode elliptic curve points to byte strings are outlined in the SEC 1 document section 2.3.3

There is a choice to use a compressed or uncompressed form. In both cases the full 0-leading byte representation of the $x$-coordinate is used. In the compressed case, the byte 02 or 03 is prepended according to the parity of the $y$-coordinate; in the uncompressed case the full 0-leading byte representation of the $y$-coordinate is prepended, with an extra leading 04 byte. The point at infinity is represented with a single 00 byte. These bytes can be used as input to a standard hash function such as SHA3 or SHA256.

These byte strings are often subsequently encoded into DER, PEM, or X962 formats for some applications.