Re: [Cfrg] I-D Action: draft-irtf-cfrg-voprf-04.txt

[Armando Faz <[e-mail]>]

Dear authors of voprf draft,

The following is an optimization for `ComputeComposites` function when
executed at the server-side. The savings reduce by half the number of
scalar multiplications (group exponentiations).

The function `ComputeComposites` calculates

     M = Σ c_i M_i  and  Z = Σ c_i Z_i

such that Z_i = x M_i for all 0 <= i < m, where x is the server's key, and
m is the number of elements.
The cost of this function is:  2m ScMult + 2(m-1) Add.

However, the calculation of Z can also be performed as:

    M = Σ c_i M_i   and   Z = x M

under the assumption that x is known. This is why the optimization applies
only at the server-side. The cost of this evaluation is now:  (m+1) ScMult
+ (m-1) Add.

Best,
-- 
Armando Faz
Cloudflare Inc.