ECVRF Auxiliary Functions

In this section, we describe the construction of \(HashToCurve\) and \(HashPoint\) in the Internet-Draft of irtf. More details can be found in irtf-vrf15.

\(\mathsf{EncodeToCurve}(X,pk)\): Given two group elements \(X, pk \in \mathbb{G}\), the function output a hash value in \(\mathbb{Z}_p\) as follows:

  1. Let \(ctr=0\).

  2. Let \(suite-string\)="0x01".

  3. Let \(seperator-front\)="0x01".

  4. Let \(seperator-back\)="0x00".

  5. Compute \(pkstr=\mathsf{PointToString}(pk)\).

  6. Define \(H\) to be "INVALID".

  7. While \(H\) is "INVALID" or \(H\) is the identity element of the group:

    • Compute \(ctrstr=\mathsf{IntToString}(ctr)\).

    • Compute \(hstr=\mathsf{keccak}\)\(( suite-string || seperator-front || pkstr || X || ctrstr || seperator-back)\).

    • Compute \(H\)=\(\mathsf{StringToPoint}(hstr)\).

    • Increment \(ctr\) by \(1\).

  8. Output \(H\).

\(\mathsf{ChallengeGeneration}(P_1,P_2,...,P_n)\): Given n elements in \(\mathbb{G}\), the hash value is computed as follows:

  1. Let \(suite-string\)="0x01".

  2. Let \(seperator-front\)="0x02".

  3. Initialize \(str=suite-string || seperator-front\).

  4. For \(i=1,2,...,n\):

    • Update \(str= str || \mathsf{PointToString}(P_i)\).

  5. Let \(separator-back\)="0x00".

  6. Update \(str=str || separator-back\).

  7. Update \(str=\mathsf{keccak}(str)\).

  8. Compute \(c=\mathsf{StringToInt}(str)\).

  9. Output \(c\).

The function \(\mathsf{PointToString}\) converts a point of an elliptic curve to a string. Many programming supports this function. For example, in python, we can use \(str(G)\) to return the string representation of a point\(G\).

The function \(\mathsf{StringToPoint}\) converts a string to a point of an elliptic curve. It is specified in section 2.3.4 of [SECG1].