ECVRF Auxiliary Functions

In this section, we describe the construction of \(HashToCurve\) and \(HashPoint\) in the Internet-Draft of irtf. More details can be found in irtf-vrf15.

\(\mathsf{EncodeToCurve}(X,pk)\): Given two group elements \(X, pk \in \mathbb{G}\), the function output a hash value in \(\mathbb{Z}_p\) as follow:

  1. Let \(ctr=0\)

  2. Let \(suite-string\)="0x01"

  3. Let \(seperator-front\)="0x01"

  4. Let \(seperator-back\)="0x00"

  5. Compute \(pkstr=\mathsf{PointToString}(pk)\)

  6. Define \(H\) to be "INVALID"

  7. While \(H\) is "INVALID" or \(H\) is the identity element of the group:

    • Compute \(ctrstr=\mathsf{IntToString}(ctr)\)

    • Compute \(hstr=\mathsf{keccak}\)\(( suite-string || seperator-front || pkstr || X || ctrstr || seperator-back)\)

    • Compute \(H\)=\(\mathsf{StringToPoint}(hstr)\)

    • Increment \(ctr\) by \(1\)

  8. Output \(H\).

\(\mathsf{ChallengeGeneration}(P_1,P_2,...,P_n)\): Given n elements in \(\mathbb{G}\), the hash value is computed as follow:

  1. Let \(suite-string\)="0x01"

  2. Let \(seperator-front\)="0x02"

  3. Initialize \(str=suite-string || seperator-front\)

  4. For \(i=1,2,...,n\):

    • Update \(str= str || \mathsf{PointToString}(P_i)\)

  5. Let \(separator-back\)="0x00"

  6. Update \(str=str || separator-back\)

  7. Update \(str=\mathsf{keccak}(str)\)

  8. Compute \(c=\mathsf{StringToInt}(str)\)

  9. Output \(c\)

The function \(\mathsf{PointToString}\) converts a point of an elliptic curve to a string. Many programming supports this function. For example, in python, we can use \(str(G)\) to return the string representation of a point\(G\).

The function \(\mathsf{StringToPoint}\) converts a string to a point of an elliptic curve. It is specified in section 2.3.4 of [SECG1]