recommendation on how to hash to ristretto255

[kwantam]

This PR adds a short appendix that defines a hash_to_curve--like function for ristretto255.

Closes #291

[kwantam]

Per @grittygrease's statement in #291, I think once we're happy with this text we should push an updated draft and request feedback on the cfrg list about this.

[chris-wood]

The content LGTM — thanks!

[kwantam]

Thanks @chris-wood! I pushed a very small edit that refs to the domain separation recommendations from the appendix, but now I'll stop messing around with it :)

[chris-wood]

The edits still look good :-) I suggest we take this to the list now. (@armfazh is out this week and won't be able to review for a while.)

[kwantam]

What's the best way to do this? Ref the list to this PR?

[chris-wood]

What's the best way to do this? Ref the list to this PR?

Yep, that’ll do!

[chris-wood]

@kwantam shall we merge this? There's been no pushback, and it seems like the best option (in my opinion).

[jedisct1]

Looks good to me.

[kwantam]

Feedback has been more positive than negative, so I think it passes the bar for inclusion 👍

There is a small remaining question that we can decide not to address now: if the ristretto draft adds decaf for edwards448 we might also want to give a recommendation for that. Happy to merge this and update later if that becomes necessary.

[chris-wood]

There is a small remaining question that we can decide not to address now: if the ristretto draft adds decaf for edwards448 we might also want to give a recommendation for that. Happy to merge this and update later if that becomes necessary.

I heard that Mike might join the ristretto255 draft and add decaf448 in the process. When that happens, we can that method in a followup PR.