I want to get a group element $h$ on the elliptic curve secp256k1. The important thing is that no one should know the discrete logarithm of $h$ with respect to $g$. That is, $h$ should be created from a public beacon and not by exponentiating $g$. What's the best way to do this?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ "that know one" $\: \mapsto \:$ "that no one" $\;\;\;\;$ $\endgroup$– user991Commented May 11, 2015 at 21:05
-
$\begingroup$ I presume you mean that not even you should know $\log_g{h}$? $\endgroup$– cpastCommented May 12, 2015 at 17:23
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
You want to hash the existing generator $g$ then coerce that hash to a curvepoint. This will result in a generator which is uniformly independent of $g$ (well, in the random oracle model anyway) and also commits to $g$ so that neither generator can be changed (say, to introduce a correlation) without changing the other.
The "obvious" way to avoid correlations, which is deriving $h$ from a nothing-up-my-sleeve (NUMS) number, suffers from the problem that the SECG generator $g$ does not have a clear origin -- it is not NUMS -- so it is possible that somebody knows the discrete log of $g$ with respect to some NUMS point. (Thanks Adam Back for pointing this risk out to me.)
To coerce a hash function to a curvepoint you can use functions from this paper (thanks Greg Maxwell for this link), for example... or you could just take the hash as the $x$-coordinate of your point and keep incrementing it by small integers until you are able to produce a valid curvepoint.
