hedera-services
hedera-services copied to clipboard
Modify HashToCurve/HashToGroup algorithm
Messages must be mapped or encoded to points in the curve to be signed. The same hashing process/strategy must be followed where the signature is produced and in all places that verify that signature.
Our current algorithm produces a SHA-256
hashed value of the message to sign, then gets a random curve point as if the hash was a random seed.
As explained by the S.C. team, cc: @Nana-EC @AlfredoG87 and @david-bakin-sl, at least the hashing method should be changed to 'keccak256` to ensure cross-chain compatibility.
A POC implementation of the hashing mechanism in solidity can be observed here: https://github.com/hashgraph/hedera-smart-contracts/blob/main/contracts/bls-signature/Pairing.sol#L57-L59
function hashToG1(bytes memory _message) internal view returns (G1Point memory) {
uint256 h = uint256(keccak256(_message));
return curveMul(P1(), h);
}
P1 is the generator point of G1. @rsinha pointed out we cannot use that implementation.
Given that the method for computing the message coordinate from a message hash has to be the same across the parings API and the possible implementations in smart contracts, this task will depend on finding a suitable algorithm for hashing that can be implemented in both places. @rsinha.