H₀ maps an arbitrary message M to a point in the G₁ subgroup used by BLS signatures. It hashes the message with an extensible KangarooTwelve output, reduces the result modulo the field prime, embeds that value on the base curve, and multiplies by the curve cofactor so the result has order r. section 18.2.1 section 18.3.2
An implementation follows this flow:
- Obtain the field prime p and compute a hash length containing the field-prime bit length plus the required security margin. section 18.2.1 section 18.3.2
- Hash the message with the H₀ domain-separation tag using KangarooTwelve, then import the output as an integer. section 18.3.2
- Reduce the integer modulo p, embed it with elptic_embed(), and multiply the embedded point by the curve cofactor. section 18.2.1 section 18.3.2
- Release temporary multiprecision integers, points, buffers, and domain-tag storage after producing the output point. section 18.3.2
C-style execution
hash0() obtains p through mget(), calls secbyte(prm), hashes dat with KangarooTwelve(), imports the bytes into hsh, reduces hsh with madd(), calls elptic_embed(), and applies sig.cobse as the cofactor. section 18.3.2
Figure 18.4 Hash \(H_0(M)\) to base curve: converts a text message into a point on the curve using a hash function.
Follow the algorithm diagram from message hashing through base-curve embedding and subgroup adjustment. section 18.2.1
