Re: [CFRG] draft-irtf-cfrg-vrf-08 research group last call (RGLC)

[Watson Ladd <[e-mail]>]

On Tue, Feb 9, 2021 at 9:10 AM Nick Sullivan
<nick=[e-mail]> wrote:
>
> Dear CFRG participants,
>
> The VRF draft has received significant reviews from the RG and the crypto panel and is ready for last call. This email commences a 2-week last call for this document that will end on Feburary 23, 2021:
>
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-vrf/

I have read the document and support publication.

My one textual comment is that typically implementation status is in a
section that says "Note to RFC editor: Remove before publication".

My one trivial substantive comment is that forcing recomputation by
the verifier of the points hashed to produce the challenge, rather
than having them hash the commitments to obtain the challenge and
verify the equations, prevents batching of verification. In
applications where multiple proofs are verified at once this is a big
improvement.

My serious substantive comment is that the formation of the
distinguisher string imposes limitations on the hash2curve registry as
the encoding is not injective. The anachronist in me suggests RS as a
way to split the different parts of the distinguisher. Hash points
seems to assume that the point format will be self-delineating. I
think this can be fixed as part of the last call comments.

Sincerely,
Watson Ladd

-- 
Astra mortemque praestare gradatim