How the H_p(x) (Hash to a point on the curve), is calculated in Monero?

The reference in [1] state that it calculated directly.

Is it also use keccack?

[1]- Zero to Monero https://getmonero.org/library/Zero-to-Monero-1-0-0.pdf

1 Answer 1


Hash to point first uses keccak, and then interprets the result as an EC point. The point is multiplied by 8 to ensure that the point is in the group of the base point G. You can see the implementation in the Monero codebase here: https://github.com/monero-project/monero/blob/8f6f674753bae7494e1ee4569004947d47a4e983/src/crypto/crypto.cpp#L481

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.