EC_hash_to_curve2 as the only option

[fcelda]

EC_hash_to_curve1 is susceptible to timing attacks. I feel quite uncomfortable about proposing this even if this property is not relevant for some use cases. Do we know how to implement the _curve2 without significant drawbacks? If we do, I propose to use _curve2 as the only option in the draft.

[goldbe]

We have _curve2 for Ed25519 (it is Elligator) but not for P256.
However _curve1 works for P256 and Ed25519. That's why its there.

[dipapado]

In the future, we can look into writing explicitly one of the other algorithms that we know of that work for any curve without being susceptible to timing attacks (e.g., [Icart09]. However, I suspect this would be slower than the current _curve1 and that is why we skipped it in NSEC5.

[goldbe]

We added Elligator for Curve25519 in draft-irtf-cfrg-vrf-02
We don't have an equivalent constant time hash for Curve P256 yet.