Indifferentiable hashing from Elligator 2

Abstract

Bernstein et al. recently introduced a system ``Elligator\u27\u27 for steganographic key distribution. At the heart of their construction are invertible maps between a finite field $\mathbb{F}$ and an elliptic curve $\mathcal{E}$ over $\mathbb{F}$. There are two such maps, called $\phi$ in the ``Elligator 1\u27\u27 system, and $\psi$ in the ``Elligator 2\u27\u27 system. Here we show two ways to construct hash functions from $\psi$ which are indifferentiable from a random oracle. Because $\psi$ is relatively simple, our analyses are also simple. One of our constructions uses a novel ``wallpapering\u27\u27 approach, whereas the other uses the hash-twice-and-add approach of Brier et al