Preferred method of generating random points

[mikelodder7]

After inspection of the code, I found some examples where a random scalar is chosen then multiplied by a point. While not inherently insecure, there is the potential side channel attack which allows an attacker to learn the discrete log of the random point.

Going forward I propose our new preferred method for creating random points is to draw random bytes and then use hash to curve. The reasoning is even if an attacker learns the random bytes they still do not learn the discrete log of the point and secondly, if the random data is manipulated or has a specific structure, the hashing effectively destroys this.