[CFRG] a few minor comments on voprf and opaque drafts

["Gajcowski, Nicholas H" <[e-mail]>]

voprf comments:

section 2.2.1

The proof batching via ComputeCompositesFast requires 3 + i scalar multiplications to generate a proof for a batch of size i.  It's fairly complicated and spans over 4 pages.  However, the "basic scheme" in [ChaumPedersen] requires 2 such multiplications for a single proof, and is simple/intuitive.  Given that, I think it makes sense to include it in the draft and perhaps move the  batching method to an annex as an option.  (FWIW I did spend a few cycles looking at the batching proof and the steps taken do seem necessary).  

pg. 11
In definition of GenerateProof appears the only use of the mod operator on scalars (it is used elsewhere on integers):

 			s = (r - c*k) mod G.order().

To be consistent, consider replacing with s = (r - c*k) as scalars lie in GF(p).  

pg. 24
3.3.3, raise InverseError when skS + m = 0.
While it is common practice to return an error message, here the server learns that the key skS is leaked as m is known externally.  Given that this is being checked, perhaps add a warning that it may be time to rekey.

OPAQUE comments

pg. 7
typo in Blind(element) API:  "revert this the" 

pg. 15 Envelope recovery
1st paragraph says recover function recovers envelope.  However, envelope (as defined in 4.1.1) consists of the nonce and auth_tag which are inputs.  Rather, client_private_key and export_key are returned.

Best,

Nick G