Hashing points

[burdges]

It's presumably impossible to hash non-compressed points without an inverse or inverse square root, yes? So non-batched scheme should probably keep both the encoded and decoded points around like dalek-cryptography/ed25519-dalek#61 right?

[hdevalence]

Yes, in order to hash points, they have to be canonicalized.

Depending on the application it can make sense to keep both forms around. This requires being able to maintain an invariant that the two representations are the same; the type system helps.

If the decompressed points are supposed to be fed into a verification check, they can be decompressed on the fly using https://doc.dalek.rs/curve25519_dalek/traits/trait.VartimeMultiscalarMul.html#tymethod.optional_multiscalar_mul

[burdges]

Cool thanks! It easy to test equality faster, but I could not imagine anyway to canonicalize faster.

[hdevalence]

For Ristretto points, as long as the data is being fed into a hash, it could be faster to hash [2]P, [2]Q, [2]R, ... instead of P, Q, R, because it allows using the batched double-and-encode function. Because Ristretto is a prime-order group, the doubling map [2] is invertible, so there's no problem with encoding points this way for hashing.