Subject: Re: [CFRG] draft-irtf-cfrg-vrf09: more comments/fixes

From: Leonid Reyzin <[email-masked]>
Date: Fri, 21 Jan 2022 23:10:10 -0500

Thank you also for these comments, which I also addressed.

On Fri, Nov 12, 2021 at 12:57 PM Christopher Peikert <christopher.peikert=
[email-masked]> wrote:

> Hello, Jiayu Xu and I have noticed a few more subtle presentational issues
> (none serious) with the current VRF draft (draft-irtf-cfrg-vrf09).
>
> 1. ECVRF_hash_points (Section 5.4.3) is specified to take as input
> "P1...PM - EC points in G."
>
> However, this function is applied to EC points that may only be elements
> of the larger group E (of all EC points), and not elements of G. For
> example, ECVRF_verify (Section 5.3) calls ECVRF_hash_points(H, Gamma, U,
> V), where Gamma, U, V may only belong to E, not G.
>
> Suggested fix: drop "in G" from the input description.
>
> This appears to be the actual intent, since the definition of
> ECVRF_hash_points just applies point_to_string to the input points, and
> works for any EC points (not just ones in G).
>
>
Indeed! Fixed [in this commit](
https://github.com/cfrg/draft-irtf-cfrg-vrf/commit/857071d514dc532bb45b2bf4c5ea779dd19077ed
)

> 2. Section 5.4.1 says: "The ECVRF_hash_to_curve algorithm takes in the VRF
> input alpha and converts it to H, an EC point in G."
>
> Suggested change: "... takes in a public key Y (an EC point) and the VRF
> input alpha ..." This matches the actual interfaces of the functions
> defined and used elsewhere.
>
> In addition, in Section 5.4.1.2 we suggest swapping the order of the
> documented inputs, to put Y first, as it is everywhere else.
>
>
This brought up a few changes: changed Y to PK_string to avoid unnecessary
type conversions, and added an explanation of why it is even there (7.10).
See [this commit](
https://github.com/cfrg/draft-irtf-cfrg-vrf/commit/857071d514dc532bb45b2bf4c5ea779dd19077ed
)