[CFRG] draft-irtf-cfrg-vrf09: more comments/fixes

[Christopher Peikert <[e-mail]>]

Hello, Jiayu Xu and I have noticed a few more subtle presentational issues
(none serious) with the current VRF draft (draft-irtf-cfrg-vrf09).

1. ECVRF_hash_points (Section 5.4.3) is specified to take as input "P1...PM
- EC points in G."

However, this function is applied to EC points that may only be elements of
the larger group E (of all EC points), and not elements of G. For
example, ECVRF_verify (Section 5.3) calls ECVRF_hash_points(H, Gamma, U,
V), where Gamma, U, V may only belong to E, not G.

Suggested fix: drop "in G" from the input description.

This appears to be the actual intent, since the definition of
ECVRF_hash_points just applies point_to_string to the input points, and
works for any EC points (not just ones in G).

2. Section 5.4.1 says: "The ECVRF_hash_to_curve algorithm takes in the VRF
input alpha and converts it to H, an EC point in G."

Suggested change: "... takes in a public key Y (an EC point) and the VRF
input alpha ..." This matches the actual interfaces of the functions
defined and used elsewhere.

In addition, in Section 5.4.1.2 we suggest swapping the order of the
documented inputs, to put Y first, as it is everywhere else.

Sincerely yours in cryptography,
Chris and Jiayu