Getting apples, bananas or cherries from hash functions !

This blog post examines insecure approaches for hashing arbitrary inputs into bounded ranges or elliptic-curve groups, showing how naive modular reduction and 'hunt-and-peck' (try-and-increment) schemes introduce biases, enable second-preimage collisions, and may leak information via timing. The authors present proof-of-concept examples, cite real-world findings (Swiss Post e-voting and issues found in Kyber Go), note that fixes were applied, and recommend using standardized, constant-time constructions such as XOF-based generation, hash_to_field, and the IETF hash_to_curve/map_to_group methods.