tree fe1634f479c72cd62b3a6af79690c19e85ee5304
parent f9e0cda2d81858d10ceeadb0d21f4026f8602cf7
author David Benjamin <davidben@google.com> 1586463679 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1586533072 +0000

Add a hash_to_scalar variation of P-521's hash_to_field.

DLEQ proofs for PMBTokens need a random oracle over scalars as well as
field elements. (Interestingly, draft-irtf-cfrg-voprf-03 section 5.1
does not specify as strong of requirements, but then their reference
implementation does rejection sampling, so it's unclear.)

Reusing the hash_to_field operation so hash calls use the domain
separation tag consistently with other hash-to-curve operations seems
prudent, so implement a companion function until the actual construction
solidifies.

Change-Id: I92d807bfddcca26db690cce0a3da551143c25ff3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40646
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>