OpenZeppelin / OpenZeppelin/compact-contracts
dev: hash to the field with RFC 9380 hash_to_field
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 55
- Forks
- 29
- Avg merge
- 5d 7h
- Merged PRs (30d)
- 25
Description
EcdhMask.kdf truncates a digest to 248 bits, so a Field masked with it never wraps and leaks its top bits (#735). A uniform mask needs a hash to the field, and the library has none: every 248-bit-or-narrower derivation biases the result.
Add hashToField to crypto/hash/Sha256, RFC 9380 hash_to_field with count = 1, m = 1, L = 64: expand msg under a DST to 64 uniform bytes and reduce them with Fq.fromUniformBytes. The expander is RFC 8017 MGF1, since expand_message_xmd needs strxor and Compact has no XOR. Verify against an independent implementation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read crypto/hash/Sha256 and the RFC 9380 hash_to_field and RFC 8017 MGF1 requirements first. Implement the specified count, m, L, and DST behavior using Fq.fromUniformBytes, then verify the output against an independent implementation; done means the derivation is uniform and the independent checks agree.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- cryptography
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100