Re: [Cfrg] Adoption request: draft-hdevalence-cfrg-ristretto

[Jeff Burdges <[e-mail]>]

Just a note in favor of adopting Ristretto:

We implemented an NSEC5 style VRF and 3-round trip Schnorr
multi-signatures, using Ristretto for the group and recommending merlin
(STROBE) for hashing:  https://github.com/w3f/schnorrkel/

https://github.com/w3f/schnorrkel/blob/master/src/vrf.rs
https://github.com/w3f/schnorrkel/blob/master/src/musig.rs

It attempts to strike a reasonable balance between missuse resistance
and flexibility, so we expose the DLEQ proofs underlying the VRF, but
address malleability aggressively to support “HDKD", and session type
are used for multi-signatures.

There is nothing in schnorrkel that really requires Ristretto of course.
 We believe however that schnorrkel supplies "the basics" for Ristretto
in a manor that works relatively consistently with the rest of the dalek
and bulletproofs ecosystem.  These basics should prove handy since no
map from Ristretto to Ed25519 will be standardised.

Best,
Jeff