Reconsider hash_to_F choices in ciphersuite

[kayabaNerve]

Ciphersuite defines five hash_to_F functions.

• Secp256k1 and P-256 using an application of https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html to their scalar fields.
• Ed25519/Ristretto using a naive concat of DST/msg, hashed by SHA2-512 and with a wide reduction.
• Ed448 using a naive concat of DST/msg, hashed by Shake3-256 with a 114 output used in a wide reduction.

The issue is the latter two, being insecure due to transcript malleability between the DST and msg.

The aforementioned draft does define Ed25519/Ed448 schemes, yet not a Ristretto scheme. We'd have to define a Ristretto scheme inspired by... Then the issue is the focus of these hash_to_F functions are to be useful, where usefulness is defined by 'canonicity'.

Given Ed25519's frequent habit of naive wide reduction, and its usage in the (presumably upcoming) FROST IETF draft, it's hard to argue it isn't the implicit standard. While the hash to curve draft arguably provides more of a standard, it's not actually intended for scalar fields.

Ed448 does have a DST defined in its EdDSA spec, which could be moved into Ciphersuite. Given how little used Ed448 is, I don't believe we'll find a widely used option anyways. Accordingly, EdDSA's may be optimal

Ideally, we don't offer any naive functions, and can create such a bound in the documentation, preventing the current footgun hash_to_F is (with a typed, distinctly separated dst tag which loses distinction) from being. While FROST does require such naivety, its own hash_to_F function is already defined and can be further written to cover its specifities.

[kayabaNerve]

The EdDSA Ed448 hash is bound "Sig448". We accordingly should not use the one from RFC-8032, yet continue looking at the hash to curve draft for it, if we change.

[kayabaNerve]

There is an issue for the IETF draft to specify test vectors for hash_to_scalar: cfrg/draft-irtf-cfrg-hash-to-curve#343

There also is a (partial?) Ristretto suite: https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#name-hashing-to-ristretto255