Hash to curve implementation

[kgncan]

Good work implementing this, and with sensible defaults.

One thing, I briefly looked at the implementation, and I'm not sure H' satisfies the requirements in the draft (which talks about using hash to curve algorithms from https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-04)

See:

Opaque/Sources/CLibOpaque/opaque.c

Line 202 in 9228f5c

// a = generator * password_n

This stack exchange answer implies that this might not be sufficient?

[louisabraham]

Do you think using 512 bits of output for the hash could solve the issue?
Also, wouldn't Universal Hashing require storing the random parameters somewhere?