I'm looking at D.3.2 Verifiably Random Base Points of NIST SP 800-186. Looks like step 5 is there to ensure that $hashlen > bitLen(q)+1$ and (potentially) discard big $e$, so $t$ is distributed properly. However, the generation method won't work in if $hashlen < bitLen(q)$ (say SHA256 and Curve448). Is there any way to fix it?

enter image description here

  • 1
    $\begingroup$ The step only checks that the division is not the same. You may choose a large hash like SHA-512. $\endgroup$
    – kelalaka
    Apr 7, 2022 at 18:43
  • $\begingroup$ @kelalaka, yes but when hashlen is smaller than qbitLen, it's an infinite loop, no? With a bigger hashlen there is no problem, but I wonder how to make it work with a smaller one $\endgroup$
    – pintor
    Apr 8, 2022 at 8:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.