proposal: use HKDF in hash_to_field

[kwantam]

See discussion in cfrg/draft-irtf-cfrg-hash-to-curve#137.

[kwantam]

The decision is to incorporate hash-to-curve by reference, so we get this "for free."

One remaining question is, do we specify how to go from secret keying material to the secret scalar value, and if so, what should we specify?

---

In the reference code we're currently using the following:

scalar_from_sk(sk):
    info = ""
    prk = hkdf_extract(None, sk)  // "None" as salt uses default specified in the RFC
    ikm = hkdf_expand(prk, info, 48)
    x = OS2IP(ikm) % q            // q is the order of the subgroup
    return x

Do we like this? Do we want to make info a non-null string?

[kwantam]

cfrg/draft-irtf-cfrg-bls-signature#1 takes care of this, so I'm closing it.