Key-image generation: What does p signify in I = xHp(P)?

Question

According to the CN whitepaper key image I is generated thusly:

I = xH_p(P)

I understand P is the one-time public key for the transaction, x the corresponding private key and H a deterministic hash function, but what is _p?

Thanks

Answer 1

There are two hash functions you'll see referenced often with Monero - there is H_s and H_p.

H_s means "hash to scalar", meaning take a keccak(256) hash and then ensure the result is a "scalar" (a positive integer less than 2²⁵² + 27742317777372353535851937790883648493).

H_p means "hash to point", meaning take a keccak(256) hash, interpret the resulting bytes as an elliptic curve point, and then multiply that curve point by 8 to force the resulting point to be in the base point group - i.e. to force it to be the case that there must exist an value x (even though x will be unknown) such that H_p(..data..) == xG.

Answer 2

Hp is the hash function but SE doesn't support subscripts well. Sometimes it can be written as H_p to avoid confusion.