Probability Distributions for Elliptic Curves in the CGL Hash Function

TL;DR

This paper analyzes the probability distribution of the CGL elliptic curve hash function, providing a complete characterization and assessing its collision resistance compared to ideal hash functions.

Contribution

We derive a theorem that fully describes all possible probability distributions of the CGL hash function, advancing understanding of its security properties.

Findings

Complete probability distribution characterization of CGL hash function

Evaluation of collision resistance relative to ideal hash functions

Use of stochastic matrices to analyze hash function behavior

Abstract

Hash functions map data of arbitrary length to data of predetermined length. Good hash functions are hard to predict, making them useful in cryptography. We are interested in the elliptic curve CGL hash function, which maps a bitstring to an elliptic curve by traversing an input-determined path through an isogeny graph. The nodes of an isogeny graph are elliptic curves, and the edges are special maps betwixt elliptic curves called isogenies. Knowing which hash values are most likely informs us of potential security weaknesses in the hash function. We use stochastic matrices to compute the expected probability distributions of the hash values. We generalize our experimental data into a theorem that completely describes all possible probability distributions of the CGL hash function. We use this theorem to evaluate the collision resistance of the CGL hash function and compare this to the collision resistance of an "ideal" hash function.