H1

As explained in Elliptic Curve Cryptography for Developers

H1 is a BLS hash function that maps concatenated public keys to an integer modulo the large prime subgroup order.

H₁ hashes the concatenation of public keys into an integer modulo the large prime torsion factor r. It supports BLS aggregation by reducing variable-length hash output into the scalar domain used by the pairing curve. section 18.2.1

An implementation follows a short pipeline:

• Accept the public-key data, the input length, and the large prime factor r. section 18.3.2
• Compute a secure output length from r, adding security-level bits before rounding to whole bytes. section 18.3.2
• Run KangarooTwelve with the H₁ domain-separation tag, import the resulting bytes as an integer, and reduce it modulo r by adding zero. section 18.3.2

Operational contrast with H₀

For concatenated public keys Q, H₁(Q) produces a scalar modulo r. H₀ uses the same hashing pattern but reduces modulo the field prime, embeds the result as a curve point, and multiplies by the cofactor; H₁ performs no curve embedding. section 18.2.1 section 18.3.2

Figure 18.5 Hash \(H_1(Q)\) to large prime factor in base curve: hashes the concatenation of public keys to a single value.

Shows H₁ mapping concatenated public keys to a value in the large prime factor domain. section 18.2.1

How Elliptic Curve Cryptography for Developers covers it

How deep it goes

Explains secure byte sizing, domain separation, hashing, integer import, modular reduction, allocation, and cleanup.

Examples

Uses concatenated public keys, the H₁ aggregation diagram, and a C-style hash1 implementation.

What it assumes

Assumes public-key concatenation, a large prime factor r, modular arithmetic, and variable-length hashing; distinguishes H₁ from H₀.

What you can do after

Apply it via KangarooTwelve to derive an integer modulo r from public-key data.

How it connects

Connects H₁ to BLS multi-signatures, H₀, KangarooTwelve, domain separation, and the torsion factor.

liveBookmanning.com

Read Elliptic Curve Cryptography for Developers on liveBook Get the book at manning.com

Related concepts

• hash functionuses · A hash function deterministically maps input data to a value in a bounded output range, commonly for indexing, lookup, comparison, or integrity checking.

This explainer was generated by Manning's knowledge graph from the text of Elliptic Curve Cryptography for Developers. The section links point to the parts of the book it draws on.