Subject: [CFRG] draft-irtf-cfrg-vrf11: small bug in test vectors

From: Brian Chen <[email-masked]>
Date: Thu, 31 Mar 2022 17:00:20 -0700

Hello CFRG,

While trying to replicate the test vectors in draft-irtf-cfrg-vrf11, I
noticed a small inaccuracy, or at least a potential source of
confusion (it doesn't affect the outputs): the test vectors for the
ECVRF cipher suites using edwards25519 list 64-byte values for the
nonce k, but k is defined as string_to_int(k_string) mod q and should
only be 32 bytes. The listed 64-byte values are actually the values
for k_string in 5.4.2.2.

Rather than just correcting the typo, I think it could be helpful to
list both k_string and k in test vectors, as I found converting
k_string to k = string_to_int(k_string) mod q difficult with some
cryptographic libraries that otherwise had good elliptic curve
support.

Note that I did not exhaustively check all values in all test vectors,
partly due to the fact that libsodium’s implementation of Elligator2
is not fully compliant with the standard.

Thanks for your time.

Best,
Brian Chen

---

From: Leonid Reyzin <[email-masked]>
Date: Sat, 9 Apr 2022 00:30:06 -0400

Thank you, Brian, for that suggestion. I updated the draft here
https://github.com/cfrg/draft-irtf-cfrg-vrf with the extra test vector
information. I will be uploading the new draft to datatracker shortly.

On Fri, Apr 1, 2022 at 12:32 PM Brian Chen <brian.chen=
[email-masked]> wrote:

> _______________________________________________
> CFRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>