0
$\begingroup$

For a ring-signature-based range proof (e.g. Ring Confidential Transactions , section 5.0.1) it is required to use some hash function from $\{0,1\}^* \to \text{scalar}$.

Is it safe to take for this purpose not a PRF (like Blake2s), but Pedersen hash (which is collision resistant but has group structure) and use $X$ or $Y$ coordinate of the curve point as the desired scalar?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.