### ECVRF Auxiliary Functions

In this section, we describe the construction of $$HashToCurve$$ and $$HashPoint$$ in the Internet-Draft of irtf. More details can be found in irtf-vrf15.

$$\mathsf{EncodeToCurve}(X,pk)$$: Given two group elements $$X, pk \in \mathbb{G}$$, the function output a hash value in $$\mathbb{Z}_p$$ as follows:

1. Let $$ctr=0$$.

2. Let $$suite-string$$="0x01".

3. Let $$seperator-front$$="0x01".

4. Let $$seperator-back$$="0x00".

5. Compute $$pkstr=\mathsf{PointToString}(pk)$$.

6. Define $$H$$ to be "INVALID".

7. While $$H$$ is "INVALID" or $$H$$ is the identity element of the group:

• Compute $$ctrstr=\mathsf{IntToString}(ctr)$$.

• Compute $$hstr=\mathsf{keccak}$$$$( suite-string || seperator-front || pkstr || X || ctrstr || seperator-back)$$.

• Compute $$H$$=$$\mathsf{StringToPoint}(hstr)$$.

• Increment $$ctr$$ by $$1$$.

8. Output $$H$$.

$$\mathsf{ChallengeGeneration}(P_1,P_2,...,P_n)$$: Given n elements in $$\mathbb{G}$$, the hash value is computed as follows:

1. Let $$suite-string$$="0x01".

2. Let $$seperator-front$$="0x02".

3. Initialize $$str=suite-string || seperator-front$$.

4. For $$i=1,2,...,n$$:

• Update $$str= str || \mathsf{PointToString}(P_i)$$.
5. Let $$separator-back$$="0x00".

6. Update $$str=str || separator-back$$.

7. Update $$str=\mathsf{keccak}(str)$$.

8. Compute $$c=\mathsf{StringToInt}(str)$$.

9. Output $$c$$.

The function $$\mathsf{PointToString}$$ converts a point of an elliptic curve to a string. Many programming supports this function. For example, in python, we can use $$str(G)$$ to return the string representation of a point$$G$$.

The function $$\mathsf{StringToPoint}$$ converts a string to a point of an elliptic curve. It is specified in section 2.3.4 of [SECG1].