tree 30b2d4f0113d735af0ee8ec01c872d942403f825
parent ec64d7e01a7ca30957c8bce38f6ad989e0b8ced1
author David Benjamin <davidben@google.com> 1675988545 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1676387565 +0000

Align the hash-to-curve formulation with draft-16.

draft-07 to draft-16 is mostly editorial, but there were a few notable
changes:

- Empty DST values are forbidden.

- The sample implementation for map_to_curve_simple_swu has completely
  changed. The new formulation has the same performance (if not a smidge
  faster), and aligning with the spec seems generally useful.

- P-384 is now paired with SHA-384, not SHA-512. As this would be a
  breaking change for the trust tokens code, I've left that in. A
  follow-up CL will add implementations of draft-16, which is expected
  to match the final draft.

Before:
Did 77000 hash-to-curve P384_XMD:SHA-512_SSWU_RO_ operations in 4025677us (19127.2 ops/sec)
Did 7156000 hash-to-scalar P384_XMD:SHA-512 operations in 4000385us (1788827.8 ops/sec)

After:
Did 77000 hash-to-curve P384_XMD:SHA-512_SSWU_RO_ operations in 4009708us (19203.4 ops/sec) [+0.4%]
Did 7327000 hash-to-scalar P384_XMD:SHA-512 operations in 4000477us (1831531.6 ops/sec) [+2.4%]

Bug: 1414562
Change-Id: Ic3c37061e325250d5d8723fd9aa263930c6023cf
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/57146
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>