Updating test vectors to sync with draft version 08 (#32 )

Publishing v0.2 (#31 )
Adding deterministic_blind_unchecked functionality under danger feature (#30 )
2021-10-25 22:06:42 -07:00 · 2021-10-18 16:47:13 -07:00 · 2021-10-18 13:24:15 -07:00 · 2021-10-15 16:56:21 -07:00 · 2021-10-14 13:55:43 -07:00 · 2021-10-14 11:09:00 -07:00
22 changed files with 1845 additions and 1579 deletions
@@ -13,11 +13,12 @@ jobs:
      fail-fast: false
      matrix:
        backend_feature:
-          - u64_backend
-          - u32_backend
-          - p256,u64_backend
+          - ristretto255_u64
+          - ristretto255_u32
+          - p256,ristretto255_u64
        frontend_feature:
-          - serialize
+          - serde
+          - danger
        toolchain:
          - stable
          - 1.51.0
@@ -32,7 +33,6 @@ jobs:
          profile: minimal
          toolchain: ${{ matrix.toolchain }}
          override: true
-          components: rustfmt, clippy

      - name: Run cargo test
        uses: actions-rs/cargo@v1
@@ -58,16 +58,19 @@ jobs:
          # for any no_std target
          - thumbv6m-none-eabi
        backend_feature:
-          - u64_backend
-          - u32_backend
-          - p256,u64_backend
+          -
+          - --features ristretto255_u64
+          - --features ristretto255_u32
+          - --features p256
        frontend_feature:
-          - serialize
+          -
+          - --features serde
+          - --features danger
    steps:
      - uses: actions/checkout@v2
      - uses: hecrj/setup-rust-action@v1
      - run: rustup target add ${{ matrix.target }}
-      - run: cargo build --verbose --target=${{ matrix.target }} --no-default-features --features ${{ matrix.frontend_feature }} --features ${{ matrix.backend_feature }}
+      - run: cargo build --verbose --target=${{ matrix.target }} --no-default-features ${{ matrix.frontend_feature }} ${{ matrix.backend_feature }}


  clippy:
@@ -83,13 +86,21 @@ jobs:
          profile: minimal
          toolchain: stable
          override: true
-          components: rustfmt, clippy
+          components: clippy

      - name: Run cargo clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: -- -D warnings
+          args: --all-targets -- -D warnings
+
+      - name: Run cargo doc
+        uses: actions-rs/cargo@v1
+        env:
+          RUSTDOCFLAGS: -D warnings
+        with:
+          command: doc
+          args: --no-deps --document-private-items --features std,p256


  format:
@@ -105,7 +116,7 @@ jobs:
          profile: minimal
          toolchain: stable
          override: true
-          components: rustfmt, clippy
+          components: rustfmt

      - name: Run cargo fmt
        uses: actions-rs/cargo@v1
@@ -1,5 +1,15 @@
 # Changelog

+## 0.3.0 (October 25, 2021)
+
+* Updated to be in sync with draft-irtf-cfrg-voprf-08
+
+## 0.2.0 (October 18, 2021)
+
+* Removed the CipherSuite interface
+* Added the "danger" feature for exposing internal functions
+* General improvements to the group interface
+
 ## 0.1.0 (September 29, 2021)

 * Initial release
@@ -1,56 +1,55 @@
 [package]
 name = "voprf"
-version = "0.1.0"
+version = "0.3.0"
 description = "An implementation of a verifiable oblivious pseudorandom function (VOPRF)"
 authors = ["Kevin Lewi <[email protected]>"]
-categories = ["no-std"]
+repository = "https://github.com/novifinancial/voprf/"
+categories = ["no-std", "algorithms", "cryptography"]
+keywords = ["oprf"]
 license = "MIT"
 edition = "2018"
 readme = "README.md"
 resolver = "2"

 [features]
-default = ["u64_backend", "serialize"]
+default = ["ristretto255_u64", "serde"]
+danger = []
+ristretto255_u64 = ["curve25519-dalek/u64_backend"]
+ristretto255_u32 = ["curve25519-dalek/u32_backend"]
+ristretto255_fiat_u64 = ["curve25519-dalek/fiat_u64_backend"]
+ristretto255_fiat_u32 = ["curve25519-dalek/fiat_u32_backend"]
+ristretto255_simd = ["curve25519-dalek/simd_backend"]
 p256 = ["num-bigint", "num-integer", "num-traits", "once_cell", "p256_"]
-std = ["curve25519-dalek/std", "getrandom", "rand/std", "rand/std_rng", "num-bigint/std", "num-integer/std", "num-traits/std"]
-u64_backend = ["curve25519-dalek/u64_backend"]
-u32_backend = ["curve25519-dalek/u32_backend"]
-serialize = ["serde", "base64", "generic-array/serde", "curve25519-dalek/serde"]
+std = []
+serde = ["serde_", "base64"]

 [dependencies]
 base64 = { version = "0.13", default-features = false, features = ["alloc"], optional = true }
-constant_time_eq = "0.1"
-curve25519-dalek = { version = "3", default-features = false }
+curve25519-dalek = { version = "3", default-features = false, optional = true }
 digest = "0.9"
 displaydoc = { version = "0.2", default-features = false }
 generic-array = "0.14"
-getrandom = { version = "0.2", optional = true }
-hkdf = "0.11"
-hmac = "0.11"
 num-bigint = { version = "0.4", default-features = false, optional = true }
 num-integer = { version = "0.1", default-features = false, optional = true }
 num-traits = { version = "0.2", default-features = false, optional = true }
 once_cell = { version = "1", default-features = false, optional = true }
 p256_ = { package = "p256", version = "0.9", default-features = false, features = ["arithmetic", "zeroize"], optional = true }
-rand = { version = "0.8", default-features = false }
-serde = { version = "1", default-features = false, features = ["alloc", "derive"], optional = true }
+rand_core = { version = "0.6", default-features = false }
+serde_ = { version = "1", package = "serde", default-features = false, optional = true }
 subtle = { version = "2.3", default-features = false }
-zeroize = { version = "1", features = ["zeroize_derive"] }
-
-[target.'cfg(target_arch = "wasm32")'.dependencies]
-getrandom = { version = "0.2", features = ["js"], optional = true }
+zeroize = { version = "1", default-features = false }

 [dev-dependencies]
-base64 = "0.13"
-bincode = "1"
-chacha20poly1305 = "0.8"
-criterion = "0.3"
+generic-array = { version = "0.14", features = ["more_lengths"] }
 hex = "0.4"
 json = "0.12"
-lazy_static = "1"
-serde_json = "1"
-sha2 = "0.9"
 proptest = "1"
+rand = "0.8"
 regex = "1"
-rustyline = "8"
-voprf = { path = "", default-features = false, features = ["std"] }
+sha2 = "0.9"
+voprf = { path = "", default-features = false, features = ["std", "danger"] }
+
+[package.metadata.docs.rs]
+features = ["danger", "p256", "std"]
+targets = []
+rustdoc-args = ["--cfg", "docsrs"]
@@ -16,7 +16,7 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:

 ```
-voprf = "0.1.0"
+voprf = "0.3"
 ```

 ### Minimum Supported Rust Version
@@ -1,17 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
-
-//! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
-
-/// Configures the underlying primitives used in VOPRF
-pub trait CipherSuite {
-    /// A finite cyclic group along with a point representation that allows some
-    /// customization on how to hash an input to a curve point. See `group::Group`.
-    type Group: crate::group::Group;
-    /// The main hash function to use (for HKDF computations and hashing transcripts).
-    type Hash: crate::hash::Hash;
-}
@@ -6,14 +6,13 @@
 // of this source tree.

 //! A list of error types which are produced during an execution of the protocol
-use core::fmt::Debug;
 #[cfg(feature = "std")]
 use std::error::Error;

 use displaydoc::Display;

 /// Represents an error in the manipulation of internal cryptographic data
-#[derive(Clone, Display, Eq, Hash, PartialEq)]
+#[derive(Clone, Debug, Display, Eq, Hash, PartialEq)]
 pub enum InternalError {
    /// Could not parse byte sequence for key
    InvalidByteSequence,
@@ -38,23 +37,5 @@ pub enum InternalError {
    ZeroScalarError,
 }

-impl Debug for InternalError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        match self {
-            Self::InvalidByteSequence => f.debug_tuple("InvalidByteSequence").finish(),
-            Self::PointError => f.debug_tuple("PointError").finish(),
-            Self::HashToCurveError => f.debug_tuple("HashToCurveError").finish(),
-            Self::SerializationError => f.debug_tuple("SerializationError").finish(),
-            Self::IncompatibleModeError => f.debug_tuple("IncompatibleModeError").finish(),
-            Self::MismatchedLengthsForCompositeInputs => f
-                .debug_tuple("MismatchedLengthsForCompositeInputs")
-                .finish(),
-            Self::ProofVerificationError => f.debug_tuple("ProofVerificationError").finish(),
-            Self::SizeError => f.debug_tuple("SizeError").finish(),
-            Self::ZeroScalarError => f.debug_tuple("ZeroScalarError").finish(),
-        }
-    }
-}
-
 #[cfg(feature = "std")]
 impl Error for InternalError {}
@@ -6,11 +6,14 @@
 // of this source tree.

 use crate::errors::InternalError;
-use crate::hash::Hash;
-use crate::serialization::i2osp;
-use alloc::vec::Vec;
+use crate::util::i2osp;
+use core::ops::Add;
 use digest::{BlockInput, Digest};
-use generic_array::typenum::Unsigned;
+use generic_array::{
+    sequence::Concat,
+    typenum::{Unsigned, U1, U2},
+    ArrayLength, GenericArray,
+};

 // Computes ceil(x / y)
 fn div_ceil(x: usize, y: usize) -> usize {
@@ -18,57 +21,68 @@ fn div_ceil(x: usize, y: usize) -> usize {
    x / y + additive
 }

-fn xor(x: &[u8], y: &[u8]) -> Result<Vec<u8>, InternalError> {
-    if x.len() != y.len() {
-        return Err(InternalError::HashToCurveError);
-    }
-
-    Ok(x.iter().zip(y).map(|(&x1, &x2)| x1 ^ x2).collect())
+fn xor<L: ArrayLength<u8>>(x: GenericArray<u8, L>, y: GenericArray<u8, L>) -> GenericArray<u8, L> {
+    x.into_iter().zip(y).map(|(x1, x2)| x1 ^ x2).collect()
 }

 /// Corresponds to the expand_message_xmd() function defined in
 /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt>
-pub fn expand_message_xmd<H: Hash>(
-    msg: &[u8],
-    dst: &[u8],
-    len_in_bytes: usize,
-) -> Result<Vec<u8>, InternalError> {
-    let b_in_bytes = <H as Digest>::OutputSize::USIZE;
-    let r_in_bytes = <H as BlockInput>::BlockSize::USIZE;
-
-    let ell = div_ceil(len_in_bytes, b_in_bytes);
+pub fn expand_message_xmd<
+    'a,
+    H: BlockInput + Digest,
+    L: ArrayLength<u8>,
+    M: IntoIterator<Item = &'a [u8]>,
+    D: ArrayLength<u8> + Add<U1>,
+>(
+    msg: M,
+    dst: GenericArray<u8, D>,
+) -> Result<GenericArray<u8, L>, InternalError>
+where
+    <D as Add<U1>>::Output: ArrayLength<u8>,
+{
+    let digest_len = <H as Digest>::OutputSize::USIZE;
+    let ell = div_ceil(L::USIZE, digest_len);
    if ell > 255 {
        return Err(InternalError::HashToCurveError);
    }
-    let dst_prime = [dst, &i2osp(dst.len(), 1)?].concat();
-    let z_pad = i2osp(0, r_in_bytes)?;
-    let l_i_b_str = i2osp(len_in_bytes, 2)?;
-    let msg_prime = [&z_pad, msg, &l_i_b_str, &i2osp(0, 1)?, &dst_prime].concat();
-
-    let mut b: Vec<Vec<u8>> = alloc::vec![H::digest(&msg_prime).to_vec()]; // b[0]
+    let dst_prime = dst.concat(i2osp::<U1>(D::USIZE)?);
+    let z_pad = i2osp::<<H as BlockInput>::BlockSize>(0)?;
+    let l_i_b_str = i2osp::<U2>(L::USIZE)?;

    let mut h = H::new();
-    h.update(&b[0]);
-    h.update(&i2osp(1, 1)?);
+
+    // msg_prime = Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime
+    h.update(z_pad);
+    for bytes in msg {
+        h.update(bytes)
+    }
+    h.update(l_i_b_str);
+    h.update(i2osp::<U1>(0)?);
    h.update(&dst_prime);
-    b.push(h.finalize_reset().to_vec()); // b[1]

-    let mut uniform_bytes: Vec<u8> = Vec::new();
-    uniform_bytes.extend_from_slice(&b[1]);
+    // b[0]
+    let b_0 = h.finalize_reset();
+    let mut b_i = GenericArray::default();

-    for i in 2..(ell + 1) {
-        h.update(xor(&b[0], &b[i - 1])?);
-        h.update(&i2osp(i, 1)?);
+    let mut uniform_bytes = GenericArray::default();
+
+    for (i, chunk) in (1..(ell + 1)).zip(uniform_bytes.chunks_mut(digest_len)) {
+        h.update(xor(b_0.clone(), b_i.clone()));
+        h.update(i2osp::<U1>(i)?);
        h.update(&dst_prime);
-        b.push(h.finalize_reset().to_vec()); // b[i]
-        uniform_bytes.extend_from_slice(&b[i]);
+        b_i = h.finalize_reset();
+        chunk.copy_from_slice(&b_i[..digest_len.min(chunk.len())]);
    }

-    Ok(uniform_bytes[..len_in_bytes].to_vec())
+    Ok(uniform_bytes)
 }

 #[cfg(test)]
 mod tests {
+    use generic_array::{
+        typenum::{U128, U32},
+        GenericArray,
+    };

    struct Params {
        msg: &'static str,
@@ -177,14 +191,22 @@ mod tests {
                378fba044a31f5cb44583a892f5969dcd73b3fa128816e",
            },
        ];
-        let dst = "QUUX-V01-CS02-with-expander";
+        let dst = GenericArray::from(*b"QUUX-V01-CS02-with-expander");

        for tv in test_vectors {
-            let uniform_bytes = super::expand_message_xmd::<sha2::Sha256>(
-                tv.msg.as_bytes(),
-                dst.as_bytes(),
-                tv.len_in_bytes,
-            )
+            let uniform_bytes = match tv.len_in_bytes {
+                32 => super::expand_message_xmd::<sha2::Sha256, U32, _, _>(
+                    Some(tv.msg.as_bytes()),
+                    dst,
+                )
+                .map(|bytes| bytes.to_vec()),
+                128 => super::expand_message_xmd::<sha2::Sha256, U128, _, _>(
+                    Some(tv.msg.as_bytes()),
+                    dst,
+                )
+                .map(|bytes| bytes.to_vec()),
+                _ => unimplemented!(),
+            }
            .unwrap();
            assert_eq!(tv.uniform_bytes, hex::encode(uniform_bytes));
        }
@@ -7,16 +7,32 @@

 //! Defines the Group trait to specify the underlying prime order group

+#[cfg(any(
+    feature = "ristretto255_u64",
+    feature = "ristretto255_u32",
+    feature = "ristretto255_fiat_u64",
+    feature = "ristretto255_fiat_u32",
+    feature = "ristretto255_simd",
+    feature = "p256",
+))]
 mod expand;
 #[cfg(feature = "p256")]
-pub(crate) mod p256;
+mod p256;
+#[cfg(any(
+    feature = "ristretto255_u64",
+    feature = "ristretto255_u32",
+    feature = "ristretto255_fiat_u64",
+    feature = "ristretto255_fiat_u32",
+    feature = "ristretto255_simd",
+))]
 mod ristretto;

 use crate::errors::InternalError;
-use crate::hash::Hash;
 use core::ops::{Add, Mul, Sub};
-use generic_array::{ArrayLength, GenericArray};
-use rand::{CryptoRng, RngCore};
+use digest::{BlockInput, Digest};
+use generic_array::{typenum::U1, ArrayLength, GenericArray};
+use rand_core::{CryptoRng, RngCore};
+use subtle::ConstantTimeEq;
 use zeroize::Zeroize;

 /// A prime-order subgroup of a base field (EC, prime-order field ...). This
@@ -24,6 +40,7 @@ use zeroize::Zeroize;
 pub trait Group:
    Copy
    + Sized
+    + ConstantTimeEq
    + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self>
    + for<'a> Add<&'a Self, Output = Self>
 {
@@ -32,14 +49,30 @@ pub trait Group:
    const SUITE_ID: usize;

    /// transforms a password and domain separation tag (DST) into a curve point
-    fn hash_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalError>;
+    fn hash_to_curve<H: BlockInput + Digest, D: ArrayLength<u8> + Add<U1>>(
+        msg: &[u8],
+        dst: GenericArray<u8, D>,
+    ) -> Result<Self, InternalError>
+    where
+        <D as Add<U1>>::Output: ArrayLength<u8>;

    /// Hashes a slice of pseudo-random bytes to a scalar
-    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, InternalError>;
+    fn hash_to_scalar<
+        'a,
+        H: BlockInput + Digest,
+        D: ArrayLength<u8> + Add<U1>,
+        I: IntoIterator<Item = &'a [u8]>,
+    >(
+        input: I,
+        dst: GenericArray<u8, D>,
+    ) -> Result<Self::Scalar, InternalError>
+    where
+        <D as Add<U1>>::Output: ArrayLength<u8>;

    /// The type of base field scalars
    type Scalar: Zeroize
        + Copy
+        + ConstantTimeEq
        + for<'a> Add<&'a Self::Scalar, Output = Self::Scalar>
        + for<'a> Sub<&'a Self::Scalar, Output = Self::Scalar>
        + for<'a> Mul<&'a Self::Scalar, Output = Self::Scalar>;
@@ -54,11 +87,11 @@ pub trait Group:

    /// Return a scalar from its fixed-length bytes representation. If the scalar
    /// is zero, then return an error.
-    fn from_scalar_slice(
-        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    fn from_scalar_slice<'a>(
+        scalar_bits: impl Into<&'a GenericArray<u8, Self::ScalarLen>>,
    ) -> Result<Self::Scalar, InternalError> {
-        let scalar = Self::from_scalar_slice_unchecked(scalar_bits)?;
-        if Self::ct_equal_scalar(&scalar, &Self::scalar_zero()) {
+        let scalar = Self::from_scalar_slice_unchecked(scalar_bits.into())?;
+        if scalar.ct_eq(&Self::scalar_zero()).into() {
            return Err(InternalError::ZeroScalarError);
        }
        Ok(scalar)
@@ -83,12 +116,12 @@ pub trait Group:

    /// Return an element from its fixed-length bytes representation. If the element
    /// is the identity element, return an error.
-    fn from_element_slice(
-        element_bits: &GenericArray<u8, Self::ElemLen>,
+    fn from_element_slice<'a>(
+        element_bits: impl Into<&'a GenericArray<u8, Self::ElemLen>>,
    ) -> Result<Self, InternalError> {
-        let elem = Self::from_element_slice_unchecked(element_bits)?;
+        let elem = Self::from_element_slice_unchecked(element_bits.into())?;

-        if Self::ct_equal(&elem, &<Self as Group>::identity()) {
+        if Self::ct_eq(&elem, &<Self as Group>::identity()).into() {
            // found the identity element
            return Err(InternalError::PointError);
        }
@@ -104,7 +137,7 @@ pub trait Group:

    /// Returns if the group element is equal to the identity (1)
    fn is_identity(&self) -> bool {
-        self.ct_equal(&<Self as Group>::identity())
+        self.ct_eq(&<Self as Group>::identity()).into()
    }

    /// Returns the identity group element
@@ -113,12 +146,6 @@ pub trait Group:
    /// Returns the scalar representing zero
    fn scalar_zero() -> Self::Scalar;

-    /// Compares in constant time if the group elements are equal
-    fn ct_equal(&self, other: &Self) -> bool;
-
-    /// Compares in constant time if the scalars are equal
-    fn ct_equal_scalar(s1: &Self::Scalar, s2: &Self::Scalar) -> bool;
-
    /// Set the contents of self to the identity value
    fn zeroize(&mut self) {
        *self = <Self as Group>::identity();
@@ -15,10 +15,10 @@

 use super::Group;
 use crate::errors::InternalError;
-use crate::hash::Hash;
-use core::ops::{Add, Div, Mul, Neg, Sub};
+use core::ops::{Add, Div, Mul, Neg};
 use core::str::FromStr;
-use generic_array::typenum::{U32, U33};
+use digest::{BlockInput, Digest};
+use generic_array::typenum::{Unsigned, U1, U2, U32, U33, U48};
 use generic_array::{ArrayLength, GenericArray};
 use num_bigint::{BigInt, Sign};
 use num_integer::Integer;
@@ -27,20 +27,28 @@ use once_cell::unsync::Lazy;
 use p256_::elliptic_curve::group::prime::PrimeCurveAffine;
 use p256_::elliptic_curve::group::GroupEncoding;
 use p256_::elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint};
-use p256_::elliptic_curve::subtle::ConstantTimeEq;
 use p256_::elliptic_curve::Field;
 use p256_::{AffinePoint, EncodedPoint, ProjectivePoint};
-use rand::{CryptoRng, RngCore};
+use rand_core::{CryptoRng, RngCore};
+use subtle::{Choice, ConditionallySelectable};

+// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-8.2
 // `L: 48`
-pub const L: usize = 48;
+pub type L = U48;

+#[cfg(feature = "p256")]
 impl Group for ProjectivePoint {
    const SUITE_ID: usize = 0x0003;

    // Implements the `hash_to_curve()` function from
    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
-    fn hash_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalError> {
+    fn hash_to_curve<H: BlockInput + Digest, D: ArrayLength<u8> + Add<U1>>(
+        msg: &[u8],
+        dst: GenericArray<u8, D>,
+    ) -> Result<Self, InternalError>
+    where
+        <D as Add<U1>>::Output: ArrayLength<u8>,
+    {
        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-8.2
        // `p: 2^256 - 2^224 + 2^192 + 2^96 - 1`
        const P: Lazy<BigInt> = Lazy::new(|| {
@@ -66,11 +74,12 @@ impl Group for ProjectivePoint {
        // `hash_to_curve` calls `hash_to_field` with a `count` of `2`
        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
        // `hash_to_field` calls `expand_message` with a `len_in_bytes` of `count * L`
-        let uniform_bytes = super::expand::expand_message_xmd::<H>(msg, dst, 2 * L)?;
+        let uniform_bytes =
+            super::expand::expand_message_xmd::<H, <L as Mul<U2>>::Output, _, _>(Some(msg), dst)?;

        // hash to curve
-        let (q0x, q0y) = hash_to_curve_simple_swu(&uniform_bytes[..L], &A, &B, &P, &Z);
-        let (q1x, q1y) = hash_to_curve_simple_swu(&uniform_bytes[L..], &A, &B, &P, &Z);
+        let (q0x, q0y) = hash_to_curve_simple_swu(&uniform_bytes[..L::USIZE], &A, &B, &P, &Z);
+        let (q1x, q1y) = hash_to_curve_simple_swu(&uniform_bytes[L::USIZE..], &A, &B, &P, &Z);

        // convert to `p256` types
        let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
@@ -86,12 +95,22 @@ impl Group for ProjectivePoint {
        Ok(p0 + p1)
    }

-    // Implements the `HashToScalar()` function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.3
-    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, InternalError> {
+    // Implements the `HashToScalar()` function
+    fn hash_to_scalar<
+        'a,
+        H: BlockInput + Digest,
+        D: ArrayLength<u8> + Add<U1>,
+        I: IntoIterator<Item = &'a [u8]>,
+    >(
+        input: I,
+        dst: GenericArray<u8, D>,
+    ) -> Result<Self::Scalar, InternalError>
+    where
+        <D as Add<U1>>::Output: ArrayLength<u8>,
+    {
        // https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#[{%22num%22:211,%22gen%22:0},{%22name%22:%22XYZ%22},70,700,0]
        // P-256 `n` is defined as `115792089210356248762697446949407573529996955224135760342 422259061068512044369`
-        const N: once_cell::unsync::Lazy<BigInt> = once_cell::unsync::Lazy::new(|| {
+        const N: Lazy<BigInt> = Lazy::new(|| {
            BigInt::from_str(
                "115792089210356248762697446949407573529996955224135760342422259061068512044369",
            )
@@ -100,16 +119,15 @@ impl Group for ProjectivePoint {

        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
        // `HashToScalar` is `hash_to_field`
-        let uniform_bytes = super::expand::expand_message_xmd::<H>(input, dst, L)?;
-        let mut bytes = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes)
+        let uniform_bytes = super::expand::expand_message_xmd::<H, L, _, _>(input, dst)?;
+        let bytes = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes)
            .mod_floor(&N)
            .to_bytes_be()
            .1;
-        bytes.resize(32, 0);
+        let mut result = GenericArray::default();
+        result[..bytes.len()].copy_from_slice(&bytes);

-        Ok(p256_::Scalar::from_bytes_reduced(GenericArray::from_slice(
-            &bytes,
-        )))
+        Ok(p256_::Scalar::from_bytes_reduced(&result))
    }

    type ElemLen = U33;
@@ -141,9 +159,11 @@ impl Group for ProjectivePoint {
    }

    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
-        let mut bytes = self.to_affine().to_encoded_point(true).as_bytes().to_vec();
-        bytes.resize(33, 0);
-        *GenericArray::from_slice(&bytes)
+        let bytes = self.to_affine().to_encoded_point(true);
+        let bytes = bytes.as_bytes();
+        let mut result = GenericArray::default();
+        result[..bytes.len()].copy_from_slice(bytes);
+        result
    }

    fn base_point() -> Self {
@@ -157,14 +177,6 @@ impl Group for ProjectivePoint {
    fn scalar_zero() -> Self::Scalar {
        Self::Scalar::zero()
    }
-
-    fn ct_equal(&self, other: &Self) -> bool {
-        self.ct_eq(other).into()
-    }
-
-    fn ct_equal_scalar(s1: &Self::Scalar, s2: &Self::Scalar) -> bool {
-        s1.ct_eq(s2).into()
-    }
 }

 /// Corresponds to the hash_to_curve_simple_swu() function defined in
@@ -172,7 +184,7 @@ impl Group for ProjectivePoint {
 ///
 /// `cmov`, `mod_floor` and `modpow` needs to be made constant-time, which
 /// will be supported after crypto-bigint is no longer experimental. See
-/// https://github.com/novifinancial/voprf/issues/13 for more context.
+/// <https://github.com/novifinancial/voprf/issues/13> for more context.

 #[allow(clippy::many_single_char_names)]
 fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
@@ -200,11 +212,6 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
        fn one(&'a self) -> FieldElement<'a> {
            self.element(&BigInt::one())
        }
-
-        /// See <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-4>
-        fn inv0(&'a self, number: &FieldElement<'a>) -> FieldElement<'a> {
-            number.pow_internal(&(self.0 - 2))
-        }
    }

    /// Finite field arithmetic
@@ -230,14 +237,6 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
        }
    }

-    impl<'a> Sub for &FieldElement<'a> {
-        type Output = FieldElement<'a>;
-
-        fn sub(self, rhs: Self) -> Self::Output {
-            self.f.element(&(&self.number - &rhs.number))
-        }
-    }
-
    impl<'a> Neg for FieldElement<'a> {
        type Output = FieldElement<'a>;

@@ -291,7 +290,7 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(

        #[allow(clippy::suspicious_arithmetic_impl)]
        fn div(self, rhs: &Self) -> Self::Output {
-            self * rhs.f.inv0(rhs)
+            self * rhs.inv0()
        }
    }

@@ -302,7 +301,10 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(

        fn pow_internal(&self, exponent: &BigInt) -> Self {
            let exponent = exponent.mod_floor(&(self.f.0 - 1));
-            self.f.element(&self.number.modpow(&exponent, self.f.0))
+            Self {
+                number: self.number.modpow(&exponent, self.f.0),
+                f: self.f,
+            }
        }

        /// Corresponds to the sqrt_3mod4() function defined in
@@ -320,6 +322,11 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
            (&self.number % 2_usize).to_i32().unwrap()
        }

+        /// See <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-4>
+        fn inv0(&self) -> Self {
+            self.pow_internal(&(self.f.0 - 2))
+        }
+
        fn is_zero(&self) -> bool {
            self.number.is_zero()
        }
@@ -335,18 +342,35 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
        }

        fn to_bytes<N: ArrayLength<u8>>(&self) -> GenericArray<u8, N> {
-            let val = self.number.mod_floor(self.f.0).to_bytes_be().1;
-            let mut bytes = alloc::vec![0u8; 32 - val.len()];
-            bytes.extend_from_slice(&val);
-            GenericArray::clone_from_slice(&bytes)
+            let bytes = self.number.to_bytes_be().1;
+            let mut result = GenericArray::default();
+            result[N::USIZE - bytes.len()..].copy_from_slice(&bytes);
+            result
        }
    }

    fn cmov<'a>(x: &FieldElement<'a>, y: &FieldElement<'a>, b: bool) -> FieldElement<'a> {
-        if b {
-            y.clone()
-        } else {
-            x.clone()
+        let f = x.f;
+
+        let x_bytes = x.number.to_bytes_le().1;
+        let mut x = [0; 32];
+        x[..x_bytes.len()].copy_from_slice(&x_bytes);
+
+        let y_bytes = y.number.to_bytes_le().1;
+        let mut y = [0; 32];
+        y[..y_bytes.len()].copy_from_slice(&y_bytes);
+
+        let mut bytes = [0; 32];
+
+        let choice = Choice::from(u8::from(b));
+
+        for ((byte, x), y) in bytes.iter_mut().zip(&x).zip(&y) {
+            *byte = u8::conditional_select(x, y, choice);
+        }
+
+        FieldElement {
+            f,
+            number: BigInt::from_bytes_le(Sign::Plus, &bytes),
        }
    }

@@ -370,7 +394,7 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
    // 3.   x1 = tv1 + tv2
    let mut x1 = &tv1 + &tv2;
    // 4.   x1 = inv0(x1)
-    x1 = f.inv0(&x1);
+    x1 = x1.inv0();
    // 5.   e1 = x1 == 0
    let e1 = x1.is_zero();
    // 6.   x1 = x1 + 1
@@ -412,6 +436,7 @@ fn hash_to_curve_simple_swu<N: ArrayLength<u8>>(
 #[cfg(test)]
 mod tests {
    use super::*;
+    use generic_array::typenum::U96;

    struct Params {
        msg: &'static str,
@@ -512,15 +537,15 @@ mod tests {
                q1y: "f6ed88a7aab56a488100e6f1174fa9810b47db13e86be999644922961206e184",
            },
        ];
-        let dst = "QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_RO_";
+        let dst = GenericArray::from(*b"QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_RO_");

        for tv in test_vectors {
-            let uniform_bytes = super::super::expand::expand_message_xmd::<sha2::Sha256>(
-                tv.msg.as_bytes(),
-                dst.as_bytes(),
-                96,
-            )
-            .unwrap();
+            let uniform_bytes =
+                super::super::expand::expand_message_xmd::<sha2::Sha256, U96, _, _>(
+                    Some(tv.msg.as_bytes()),
+                    dst,
+                )
+                .unwrap();

            let u0 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[..48]).mod_floor(&P);
            let u1 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[48..]).mod_floor(&P);
@@ -7,26 +7,42 @@

 use super::Group;
 use crate::errors::InternalError;
-use crate::hash::Hash;
 use core::convert::TryInto;
+use core::ops::Add;
 use curve25519_dalek::{
    constants::RISTRETTO_BASEPOINT_POINT,
    ristretto::{CompressedRistretto, RistrettoPoint},
    scalar::Scalar,
    traits::Identity,
 };
-use generic_array::{typenum::U32, GenericArray};
-use rand::{CryptoRng, RngCore};
-use subtle::ConstantTimeEq;
+use digest::{BlockInput, Digest};
+use generic_array::{
+    typenum::{U1, U32, U64},
+    ArrayLength, GenericArray,
+};
+use rand_core::{CryptoRng, RngCore};

 /// The implementation of such a subgroup for Ristretto
+#[cfg(any(
+    feature = "ristretto255_u64",
+    feature = "ristretto255_u32",
+    feature = "ristretto255_fiat_u64",
+    feature = "ristretto255_fiat_u32",
+    feature = "ristretto255_simd",
+))]
 impl Group for RistrettoPoint {
    const SUITE_ID: usize = 0x0001;

    // Implements the `hash_to_ristretto255()` function from
    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
-    fn hash_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalError> {
-        let uniform_bytes = super::expand::expand_message_xmd::<H>(msg, dst, 64)?;
+    fn hash_to_curve<H: BlockInput + Digest, D: ArrayLength<u8> + Add<U1>>(
+        msg: &[u8],
+        dst: GenericArray<u8, D>,
+    ) -> Result<Self, InternalError>
+    where
+        <D as Add<U1>>::Output: ArrayLength<u8>,
+    {
+        let uniform_bytes = super::expand::expand_message_xmd::<H, U64, _, _>(Some(msg), dst)?;

        Ok(RistrettoPoint::from_uniform_bytes(
            uniform_bytes
@@ -38,8 +54,19 @@ impl Group for RistrettoPoint {

    // Implements the `HashToScalar()` function from
    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1
-    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, InternalError> {
-        let uniform_bytes = super::expand::expand_message_xmd::<H>(input, dst, 64)?;
+    fn hash_to_scalar<
+        'a,
+        H: BlockInput + Digest,
+        D: ArrayLength<u8> + Add<U1>,
+        I: IntoIterator<Item = &'a [u8]>,
+    >(
+        input: I,
+        dst: GenericArray<u8, D>,
+    ) -> Result<Self::Scalar, InternalError>
+    where
+        <D as Add<U1>>::Output: ArrayLength<u8>,
+    {
+        let uniform_bytes = super::expand::expand_message_xmd::<H, U64, _, _>(input, dst)?;

        Ok(Scalar::from_bytes_mod_order_wide(
            uniform_bytes
@@ -60,20 +87,9 @@ impl Group for RistrettoPoint {
    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
        loop {
            let scalar = {
-                #[cfg(not(test))]
-                {
-                    let mut scalar_bytes = [0u8; 64];
-                    rng.fill_bytes(&mut scalar_bytes);
-                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
-                }
-
-                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
-                #[cfg(test)]
-                {
-                    let mut scalar_bytes = [0u8; 32];
-                    rng.fill_bytes(&mut scalar_bytes);
-                    Scalar::from_bytes_mod_order(scalar_bytes)
-                }
+                let mut scalar_bytes = [0u8; 64];
+                rng.fill_bytes(&mut scalar_bytes);
+                Scalar::from_bytes_mod_order_wide(&scalar_bytes)
            };

            if scalar != Scalar::zero() {
@@ -115,12 +131,4 @@ impl Group for RistrettoPoint {
    fn scalar_zero() -> Self::Scalar {
        Self::Scalar::zero()
    }
-
-    fn ct_equal(&self, other: &Self) -> bool {
-        ConstantTimeEq::ct_eq(self, other).into()
-    }
-
-    fn ct_equal_scalar(s1: &Self::Scalar, s2: &Self::Scalar) -> bool {
-        ConstantTimeEq::ct_eq(s1, s2).into()
-    }
 }
@@ -9,49 +9,42 @@

 use crate::errors::InternalError;
 use crate::group::Group;
-use crate::CipherSuite;

 // Test that the deserialization of a group element should throw an error
 // if the identity element can be deserialized properly

 #[test]
 fn test_group_properties() -> Result<(), InternalError> {
-    use crate::tests::Ristretto255Sha512;
+    use curve25519_dalek::ristretto::RistrettoPoint;

-    test_identity_element_error::<Ristretto255Sha512>()?;
-    test_zero_scalar_error::<Ristretto255Sha512>()?;
+    test_identity_element_error::<RistrettoPoint>()?;
+    test_zero_scalar_error::<RistrettoPoint>()?;

    #[cfg(feature = "p256")]
    {
-        use crate::tests::P256Sha256;
+        use p256_::ProjectivePoint;

-        test_identity_element_error::<P256Sha256>()?;
-        test_zero_scalar_error::<P256Sha256>()?;
+        test_identity_element_error::<ProjectivePoint>()?;
+        test_zero_scalar_error::<ProjectivePoint>()?;
    }

    Ok(())
 }

 // Checks that the identity element cannot be deserialized
-fn test_identity_element_error<CS: CipherSuite>() -> Result<(), InternalError> {
-    let identity = CS::Group::identity();
-    let result = CS::Group::from_element_slice(&identity.to_arr());
-    assert!(match result {
-        Err(InternalError::PointError) => true,
-        _ => false,
-    });
+fn test_identity_element_error<G: Group>() -> Result<(), InternalError> {
+    let identity = G::identity();
+    let result = G::from_element_slice(&identity.to_arr());
+    assert!(matches!(result, Err(InternalError::PointError)));

    Ok(())
 }

 // Checks that the zero scalar cannot be deserialized
-fn test_zero_scalar_error<CS: CipherSuite>() -> Result<(), InternalError> {
-    let zero_scalar = CS::Group::scalar_zero();
-    let result = CS::Group::from_scalar_slice(&CS::Group::scalar_as_bytes(zero_scalar));
-    assert!(match result {
-        Err(InternalError::ZeroScalarError) => true,
-        _ => false,
-    });
+fn test_zero_scalar_error<G: Group>() -> Result<(), InternalError> {
+    let zero_scalar = G::scalar_zero();
+    let result = G::from_scalar_slice(&G::scalar_as_bytes(zero_scalar));
+    assert!(matches!(result, Err(InternalError::ZeroScalarError)));

    Ok(())
 }
@@ -1,17 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
-
-//! A convenience trait for digest bounds used throughout the library
-
-use digest::{BlockInput, FixedOutput, Reset, Update};
-
-/// Trait inheriting the requirements from digest::Digest for compatibility with HKDF and HMAC
-// Associated types could be simplified when they are made as defaults:
-// https://github.com/rust-lang/rust/issues/29661
-pub trait Hash: Update + BlockInput + FixedOutput + Reset + Default + Clone {}
-
-impl<T: Update + BlockInput + FixedOutput + Reset + Default + Clone> Hash for T {}
@@ -5,134 +5,124 @@
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
 // of this source tree.

-macro_rules! impl_debug_eq_hash_for {
-    (struct $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:ident$(, $field2:ident)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
-        impl$(<$($gen$(: $bound)?),+>)? core::fmt::Debug for $name$(<$($gen),+>)?
-        $(where $($type: core::fmt::Debug,)+)?
+/// Implement multiple similar traits at the same time. Additionally used to
+/// find `#[bind]` markers to build `while` constraint.
+macro_rules! impl_with_bounds {
+    (
+        $name:ident$(<$($gen:ident$(: $bound1:tt $(+ $bound2:tt)*)?),+>)?
+        // only collect types marked with `#bind`
+        // `|` prevents error about a possibly empty token
+        // `@` prevents ambiguity between `$_2` and `$trait1`
+        // `#` prevents ambiguity between marker traits and `$_2`
+        $(|$(@#bind: $type:ty|,)? $(@#pd: $_1:ty|,)? $(@$_2:ty|,)?)+
+        $trait1:path => { $($fn1:item)? },
+        $($trait2:path => { $($fn2:item)? },)*
+    ) => {
+        impl$(<$($gen$(: $bound1 $(+ $bound2)*)?),+>)? $trait1 for $name$(<$($gen),+>)?
+        where
+            $($($type: $trait1,)?)+
        {
-            fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-                f.debug_struct("$name")
-                .field("$field1", &self.$field1)
-                $(.field("$field2", &self.$field2))*
-                .finish()
-            }
+            $($fn1)?
        }

-        impl$(<$($gen$(: $bound)?),+>)? Eq for $name$(<$($gen),+>)?
-        $(where $($type: Eq,)+)?
-        {}
-
-        impl$(<$($gen$(: $bound)?),+>)? PartialEq for $name$(<$($gen),+>)?
-        $(where $($type: PartialEq,)+)?
-        {
-            fn eq(&self, other: &Self) -> bool {
-                PartialEq::eq(&self.$field1, &other.$field1)
-                $(&& PartialEq::eq(&self.$field2, &other.$field2))*
-            }
-        }
-
-        impl$(<$($gen$(: $bound)?),+>)? core::hash::Hash for $name$(<$($gen),+>)?
-        $(where $($type: core::hash::Hash,)+)?
-        {
-            fn hash<H: core::hash::Hasher>(&self, state: &mut H) {
-                core::hash::Hash::hash(&self.$field1, state);
-                $(core::hash::Hash::hash(&self.$field2, state);)*
-            }
-        }
+        impl_with_bounds!(
+            $name$(<$($gen$(: $bound1 $(+ $bound2)*)?),+>)?
+            $(|$(@#bind: $type|,)? $(@#pd: $_1|,)? $(@$_2|,)?)+
+            $($trait2 => { $($fn2)? },)*
+        );
    };
-    (tuple $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:tt$(, $field2:tt)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
-        impl$(<$($gen$(: $bound)?),+>)? core::fmt::Debug for $name$(<$($gen),+>)?
-        $(where $($type: core::fmt::Debug,)+)?
-        {
-            fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-                f.debug_tuple("$name")
-                .field(&self.$field1)
-                $(.field(&self.$field2))*
-                .finish()
-            }
-        }
+    // signature triggered when all traits are exhausted
+    (
+        $name:ident$(<$($gen:ident$(: $bound1:tt$( + $bound2:tt)*)?),+>)?
+        $(|$(@#bind: $type:ty|,)? $(@#pd: $_1:ty|,)? $(@$_2:ty|,)?)+
+    ) => { };
+}

-        impl$(<$($gen$(: $bound)?),+>)? Eq for $name$(<$($gen),+>)?
-        $(where $($type: Eq,)+)?
-        {}
-
-        impl$(<$($gen$(: $bound)?),+>)? PartialEq for $name$(<$($gen),+>)?
-        $(where $($type: PartialEq,)+)?
-        {
-            fn eq(&self, other: &Self) -> bool {
-                PartialEq::eq(&self.$field1, &other.$field1)
-                $(&& PartialEq::eq(&self.$field2, &other.$field2))*
-            }
-        }
-
-        impl$(<$($gen$(: $bound)?),+>)? core::hash::Hash for $name$(<$($gen),+>)?
-        $(where $($type: core::hash::Hash,)+)?
-        {
-            fn hash<H: core::hash::Hasher>(&self, state: &mut H) {
-                core::hash::Hash::hash(&self.$field1, state);
-                $(core::hash::Hash::hash(&self.$field2, state);)*
-            }
-        }
+/// Skips attempt to call [`zeroize()`](zeroize::Zeroize::zeroize) on
+/// [`PhantomData`](core::marker::PhantomData).
+macro_rules! impl_internal_zeroize {
+    ($self_:ident, #pd $field:ident) => {};
+    ($self_:ident, #bind $field:ident) => {
+        $self_.$field.zeroize();
+    };
+    ($self_:ident, $field:ident) => {
+        $self_.$field.zeroize();
    };
 }

-macro_rules! impl_clone_for {
-    (struct $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:ident$(, $field2:ident)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
-        impl$(<$($gen$(: $bound)?),+>)? Clone for $name$(<$($gen),+>)?
-        $(where $($type: Clone,)+)?
-        {
-            fn clone(&self) -> Self {
-                Self {
-                    $field1: self.$field1.clone(),
-                    $($field2: self.$field2.clone(),)*
+macro_rules! impl_traits_for {
+    (
+        // include documentation, Rust can't connect documentation from outside
+        // a macro to a `struct` generated by a macro
+        $(#[doc = $doc:literal])*
+        $vis:vis struct $name:ident$(<$($gen:ident$(: $bound1:tt $(+ $bound2:tt)*)?),+$(,)?>)? {
+            $(#[$attr1:ident])? $vis1:vis $field1:ident: $type1:ty$(,
+            $(#[$attr2:ident])? $vis2:vis $field2:ident: $type2:ty)*$(,)?
+        }
+    ) => {
+        // build `struct` itself
+        $(#[doc = $doc])*
+        $vis struct $name$(<$($gen$(: $bound1 $(+$bound2)*)?),+>)? {
+            $vis1 $field1: $type1,
+            $($vis2 $field2: $type2),*
+        }
+
+        // implement traits that require specific `where` constraints with the
+        // help of `#[bind]`
+        impl_with_bounds!(
+            $name$(<$($gen$(: $bound1 $(+ $bound2)*)?),+>)?
+            |@$(#$attr1:)? $type1|, $(|@$(#$attr2:)? $type2|,)*
+            core::fmt::Debug => {
+                fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+                    f.debug_struct("$name")
+                    .field("$field1", &self.$field1)
+                    $(.field("$field2", &self.$field2))*
+                    .finish()
                }
-            }
-        }
-    };
-    (tuple $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:tt$(, $field2:tt)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
-        impl$(<$($gen$(: $bound)?),+>)? Clone for $name$(<$($gen),+>)?
-        $(where $($type: Clone,)+)?
-        {
-            fn clone(&self) -> Self {
-                Self(
-                    self.$field1.clone(),
-                    $(self.$field2.clone(),)*
-                )
-            }
-        }
-    };
-}
+            },
+            Eq => { },
+            PartialEq => {
+                fn eq(&self, other: &Self) -> bool {
+                    PartialEq::eq(&self.$field1, &other.$field1)
+                    $(&& PartialEq::eq(&self.$field2, &other.$field2))*
+                }
+            },
+            core::hash::Hash => {
+                fn hash<_H: core::hash::Hasher>(&self, state: &mut _H) {
+                    core::hash::Hash::hash(&self.$field1, state);
+                    $(core::hash::Hash::hash(&self.$field2, state);)*
+                }
+            },
+            Clone => {
+                fn clone(&self) -> Self {
+                    Self {
+                        $field1: self.$field1.clone(),
+                        $($field2: self.$field2.clone(),)*
+                    }
+                }
+            },
+        );

-macro_rules! impl_zeroize_on_drop_for {
-    (struct $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:ident$(, $field2:ident)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
-        impl$(<$($gen$(: $bound)?),+>)? zeroize::Zeroize for $name$(<$($gen),+>)?
+        impl$(<$($gen$(: $bound1 $(+ $bound2)*)?),+>)? zeroize::Zeroize for $name$(<$($gen),+>)?
        {
            fn zeroize(&mut self) {
-                self.$field1.zeroize();
-                $(self.$field2.zeroize();)*
+                impl_internal_zeroize!(self, $(#$attr1)? $field1);
+                $(impl_internal_zeroize!(self, $(#$attr2)? $field2);)*
            }
        }

-        impl$(<$($gen$(: $bound)?),+>)? Drop for $name$(<$($gen),+>)?
+        impl$(<$($gen$(: $bound1 $(+ $bound2)*)?),+>)? Drop for $name$(<$($gen),+>)?
        {
            fn drop(&mut self) {
-                #[allow(unused_imports)]
-                use zeroize::Zeroize;
-                self.$field1.zeroize();
-                $(self.$field2.zeroize();)*
+                zeroize::Zeroize::zeroize(self);
            }
        }
-    };
-}

-/// Inner macro used for deriving `serde`'s `Serialize` and `Deserialize` traits.
-macro_rules! impl_serialize_and_deserialize_for {
-    ($t:ident) => {
-        #[cfg(feature = "serialize")]
-        impl<CS: CipherSuite> serde::Serialize for $t<CS> {
+        #[cfg(feature = "serde")]
+        impl$(<$($gen$(: $bound1 $(+ $bound2)*)?),+>)? serde_::Serialize for $name$(<$($gen),+>)? {
            fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
            where
-                S: serde::Serializer,
+                S: serde_::Serializer,
            {
                if serializer.is_human_readable() {
                    serializer.serialize_str(&base64::encode(&self.serialize()))
@@ -142,62 +132,22 @@ macro_rules! impl_serialize_and_deserialize_for {
            }
        }

-        #[cfg(feature = "serialize")]
-        impl<'de, CS: CipherSuite> serde::Deserialize<'de> for $t<CS> {
+        #[cfg(feature = "serde")]
+        impl<'de, $($($gen$(: $bound1 $(+ $bound2)*)?),+)?> serde_::Deserialize<'de> for $name$(<$($gen),+>)? {
            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
            where
-                D: serde::Deserializer<'de>,
+                D: serde_::Deserializer<'de>,
            {
+                use serde_::de::Error;
+
                if deserializer.is_human_readable() {
                    let s = <&str>::deserialize(deserializer)?;
-                    $t::<CS>::deserialize(&base64::decode(s).map_err(serde::de::Error::custom)?)
-                        .map_err(serde::de::Error::custom)
+                    Self::deserialize(&base64::decode(s).map_err(Error::custom)?)
                } else {
-                    struct ByteVisitor<CS: CipherSuite> {
-                        marker: core::marker::PhantomData<CS>,
-                    }
-                    impl<'de, CS: CipherSuite> serde::de::Visitor<'de> for ByteVisitor<CS> {
-                        type Value = $t<CS>;
-                        fn expecting(
-                            &self,
-                            formatter: &mut core::fmt::Formatter,
-                        ) -> core::fmt::Result {
-                            formatter.write_str(core::concat!(
-                                "the byte representation of a ",
-                                core::stringify!($t)
-                            ))
-                        }
-
-                        fn visit_bytes<E>(self, value: &[u8]) -> Result<Self::Value, E>
-                        where
-                            E: serde::de::Error,
-                        {
-                            $t::<CS>::deserialize(value).map_err(|_| {
-                                serde::de::Error::invalid_value(
-                                    serde::de::Unexpected::Bytes(value),
-                                    &core::concat!(
-                                        "invalid byte sequence for ",
-                                        core::stringify!($t)
-                                    ),
-                                )
-                            })
-                        }
-                    }
-                    deserializer.deserialize_bytes(ByteVisitor::<CS> {
-                        marker: core::marker::PhantomData,
-                    })
+                    Self::deserialize(<&[u8]>::deserialize(deserializer)?)
                }
+                .map_err(Error::custom)
            }
        }
    };
 }
-
-// Convenience macro for implementing all of the above traits
-macro_rules! impl_traits_for {
-    (struct $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:ident$(, $field2:ident)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
-        impl_debug_eq_hash_for!(struct $name$(<$($gen$(: $bound)?),+>)?, [$field1$(, $field2)*], $([$($type),+])?);
-        impl_clone_for!(struct $name$(<$($gen$(: $bound)?),+>)?, [$field1$(, $field2)*], $([$($type),+])?);
-        impl_zeroize_on_drop_for!(struct $name$(<$($gen$(: $bound)?),+>)?, [$field1$(, $field2)*], $([$($type),+])?);
-        impl_serialize_and_deserialize_for!($name);
-    }
-}
@@ -8,7 +8,7 @@
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!
 //! Note: This implementation is in sync with
-//! [draft-irtf-cfrg-voprf-07](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html),
+//! [draft-irtf-cfrg-voprf-08](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html),
 //! but this specification is subject to change, until the final version
 //! published by the IETF.
 //!
@@ -24,12 +24,8 @@
 //! We will use the following choices in this example:
 //!
 //! ```
-//! use voprf::CipherSuite;
-//! struct Default;
-//! impl CipherSuite for Default {
-//!     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//!     type Hash = sha2::Sha512;
-//! }
+//! type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! type Hash = sha2::Sha512;
 //! ```
 //!
 //! ## Modes of Operation
@@ -56,17 +52,13 @@
 //! client evaluations.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! use voprf::NonVerifiableServer;
 //! use rand::{rngs::OsRng, RngCore};
 //!
 //! let mut server_rng = OsRng;
-//! let server = NonVerifiableServer::<Default>::new(&mut server_rng)
+//! let server = NonVerifiableServer::<Group, Hash>::new(&mut server_rng)
 //!    .expect("Unable to construct server");
 //! ```
 //!
@@ -79,18 +71,14 @@
 //! step of the VOPRF protocol.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! use voprf::NonVerifiableClient;
 //! use rand::{rngs::OsRng, RngCore};
 //!
 //! let mut client_rng = OsRng;
-//! let client_blind_result = NonVerifiableClient::<Default>::blind(
-//!     b"input",
+//! let client_blind_result = NonVerifiableClient::<Group, Hash>::blind(
+//!     b"input".to_vec(),
 //!     &mut client_rng,
 //! ).expect("Unable to construct client");
 //! ```
@@ -104,28 +92,23 @@
 //! [EvaluationElement] to be sent to the client.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::NonVerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
 //! # let mut client_rng = OsRng;
-//! # let client_blind_result = NonVerifiableClient::<Default>::blind(
-//! #     b"input",
+//! # let client_blind_result = NonVerifiableClient::<Group, Hash>::blind(
+//! #     b"input".to_vec(),
 //! #     &mut client_rng,
 //! # ).expect("Unable to construct client");
 //! # use voprf::NonVerifiableServer;
 //! # let mut server_rng = OsRng;
-//! # let server = NonVerifiableServer::<Default>::new(&mut server_rng)
+//! # let server = NonVerifiableServer::<Group, Hash>::new(&mut server_rng)
 //! #   .expect("Unable to construct server");
-//! use voprf::Metadata;
 //! let server_evaluate_result = server.evaluate(
 //!     client_blind_result.message,
-//!     &Metadata::none(),
+//!     None,
 //! ).expect("Unable to perform server evaluate");
 //! ```
 //!
@@ -133,40 +116,33 @@
 //!
 //! In the final step, the client takes as input the message from
 //! [NonVerifiableServer::evaluate] (an [EvaluationElement]), and runs
-//! [NonVerifiableClient::finalize] to produce a
-//! [NonVerifiableClientFinalizeResult], which consists of an
-//! output for the protocol.
+//! [NonVerifiableClient::finalize] to produce an output for the protocol.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::NonVerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
 //! # let mut client_rng = OsRng;
-//! # let client_blind_result = NonVerifiableClient::<Default>::blind(
-//! #     b"input",
+//! # let client_blind_result = NonVerifiableClient::<Group, Hash>::blind(
+//! #     b"input".to_vec(),
 //! #     &mut client_rng,
 //! # ).expect("Unable to construct client");
 //! # use voprf::NonVerifiableServer;
 //! # let mut server_rng = OsRng;
-//! # let server = NonVerifiableServer::<Default>::new(&mut server_rng)
+//! # let server = NonVerifiableServer::<Group, Hash>::new(&mut server_rng)
 //! #   .expect("Unable to construct server");
 //! # let server_evaluate_result = server.evaluate(
 //! #     client_blind_result.message,
-//! #     &Metadata::none(),
+//! #     None,
 //! # ).expect("Unable to perform server evaluate");
-//! use voprf::Metadata;
 //! let client_finalize_result = client_blind_result.state.finalize(
 //!     server_evaluate_result.message,
-//!     &Metadata::none(),
+//!     None,
 //! ).expect("Unable to perform client finalization");
 //!
-//! println!("VOPRF output: {:?}", client_finalize_result.output.to_vec());
+//! println!("VOPRF output: {:?}", client_finalize_result.to_vec());
 //! ```
 //!
 //! ## Verifiable Mode
@@ -189,17 +165,13 @@
 //! client evaluations.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! use voprf::VerifiableServer;
 //! use rand::{rngs::OsRng, RngCore};
 //!
 //! let mut server_rng = OsRng;
-//! let server = VerifiableServer::<Default>::new(&mut server_rng)
+//! let server = VerifiableServer::<Group, Hash>::new(&mut server_rng)
 //!    .expect("Unable to construct server");
 //!
 //! // To be sent to the client
@@ -219,18 +191,14 @@
 //! step of the VOPRF protocol.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! use voprf::VerifiableClient;
 //! use rand::{rngs::OsRng, RngCore};
 //!
 //! let mut client_rng = OsRng;
-//! let client_blind_result = VerifiableClient::<Default>::blind(
-//!     b"input",
+//! let client_blind_result = VerifiableClient::<Group, Hash>::blind(
+//!     b"input".to_vec(),
 //!     &mut client_rng,
 //! ).expect("Unable to construct client");
 //! ```
@@ -244,29 +212,24 @@
 //! [EvaluationElement] to be sent to the client along with a proof.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::VerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
 //! # let mut client_rng = OsRng;
-//! # let client_blind_result = VerifiableClient::<Default>::blind(
-//! #     b"input",
+//! # let client_blind_result = VerifiableClient::<Group, Hash>::blind(
+//! #     b"input".to_vec(),
 //! #     &mut client_rng,
 //! # ).expect("Unable to construct client");
 //! # use voprf::VerifiableServer;
 //! # let mut server_rng = OsRng;
-//! # let server = VerifiableServer::<Default>::new(&mut server_rng)
+//! # let server = VerifiableServer::<Group, Hash>::new(&mut server_rng)
 //! #   .expect("Unable to construct server");
-//! use voprf::Metadata;
 //! let server_evaluate_result = server.evaluate(
 //!     &mut server_rng,
 //!     client_blind_result.message,
-//!     &Metadata::none(),
+//!     None,
 //! ).expect("Unable to perform server evaluate");
 //! ```
 //!
@@ -275,43 +238,36 @@
 //! In the final step, the client takes as input the message from
 //! [VerifiableServer::evaluate] (an [EvaluationElement]),
 //! the proof, and the server's public key, and runs
-//! [VerifiableClient::finalize] to produce a
-//! [VerifiableClientFinalizeResult], which consists of an
-//! output for the protocol.
+//! [VerifiableClient::finalize] to produce an output for the protocol.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::VerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
 //! # let mut client_rng = OsRng;
-//! # let client_blind_result = VerifiableClient::<Default>::blind(
-//! #     b"input",
+//! # let client_blind_result = VerifiableClient::<Group, Hash>::blind(
+//! #     b"input".to_vec(),
 //! #     &mut client_rng,
 //! # ).expect("Unable to construct client");
 //! # use voprf::VerifiableServer;
 //! # let mut server_rng = OsRng;
-//! # let server = VerifiableServer::<Default>::new(&mut server_rng)
+//! # let server = VerifiableServer::<Group, Hash>::new(&mut server_rng)
 //! #   .expect("Unable to construct server");
 //! # let server_evaluate_result = server.evaluate(
 //! #     &mut server_rng,
 //! #     client_blind_result.message,
-//! #     &Metadata::none(),
+//! #     None,
 //! # ).expect("Unable to perform server evaluate");
-//! use voprf::Metadata;
 //! let client_finalize_result = client_blind_result.state.finalize(
 //!     server_evaluate_result.message,
 //!     server_evaluate_result.proof,
 //!     server.get_public_key(),
-//!     &Metadata::none(),
+//!     None,
 //! ).expect("Unable to perform client finalization");
 //!
-//! println!("VOPRF output: {:?}", client_finalize_result.output.to_vec());
+//! println!("VOPRF output: {:?}", client_finalize_result.to_vec());
 //! ```
 //!
 //! # Advanced Usage
@@ -333,12 +289,8 @@
 //! states and messages:
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::VerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
@@ -346,8 +298,8 @@
 //! let mut client_states = vec![];
 //! let mut client_messages = vec![];
 //! for _ in 0..10 {
-//!     let client_blind_result = VerifiableClient::<Default>::blind(
-//!         b"input",
+//!     let client_blind_result = VerifiableClient::<Group, Hash>::blind(
+//!         b"input".to_vec(),
 //!         &mut client_rng,
 //!     ).expect("Unable to construct client");
 //!     client_states.push(client_blind_result.state);
@@ -361,12 +313,8 @@
 //! along with a single proof:
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::VerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
@@ -374,38 +322,32 @@
 //! # let mut client_states = vec![];
 //! # let mut client_messages = vec![];
 //! # for _ in 0..10 {
-//! #     let client_blind_result = VerifiableClient::<Default>::blind(
-//! #         b"input",
+//! #     let client_blind_result = VerifiableClient::<Group, Hash>::blind(
+//! #         b"input".to_vec(),
 //! #        &mut client_rng,
 //! #     ).expect("Unable to construct client");
 //! #     client_states.push(client_blind_result.state);
 //! #     client_messages.push(client_blind_result.message);
 //! # }
-//! # use voprf::Metadata;
 //! # use voprf::VerifiableServer;
 //! let mut server_rng = OsRng;
-//! # let server = VerifiableServer::<Default>::new(&mut server_rng)
+//! # let server = VerifiableServer::<Group, Hash>::new(&mut server_rng)
 //! #   .expect("Unable to construct server");
 //! let server_batch_evaluate_result = server.batch_evaluate(
 //!     &mut server_rng,
 //!     &client_messages,
-//!     &Metadata::none(),
+//!     None,
 //! ).expect("Unable to perform server batch evaluate");
 //! ```
 //!
 //! Then, the client calls [VerifiableClient::batch_finalize] on
 //! the client states saved from the first step, along with the messages
-//! returned by the server (constructing a [BatchFinalizeInput]), along with the
-//! server's proof, in order to produce a vector of outputs if the proof
-//! verifies correctly.
+//! returned by the server, along with the server's proof, in order to produce
+//! a vector of outputs if the proof verifies correctly.
 //!
 //! ```
-//! # use voprf::CipherSuite;
-//! # struct Default;
-//! # impl CipherSuite for Default {
-//! #     type Group = curve25519_dalek::ristretto::RistrettoPoint;
-//! #     type Hash = sha2::Sha512;
-//! # }
+//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
+//! # type Hash = sha2::Sha512;
 //! # use voprf::VerifiableClient;
 //! # use rand::{rngs::OsRng, RngCore};
 //! #
@@ -413,36 +355,31 @@
 //! # let mut client_states = vec![];
 //! # let mut client_messages = vec![];
 //! # for _ in 0..10 {
-//! #     let client_blind_result = VerifiableClient::<Default>::blind(
-//! #         b"input",
+//! #     let client_blind_result = VerifiableClient::<Group, Hash>::blind(
+//! #         b"input".to_vec(),
 //! #        &mut client_rng,
 //! #     ).expect("Unable to construct client");
 //! #     client_states.push(client_blind_result.state);
 //! #     client_messages.push(client_blind_result.message);
 //! # }
-//! # use voprf::Metadata;
 //! # use voprf::VerifiableServer;
-//! use voprf::BatchFinalizeInput;
 //! let mut server_rng = OsRng;
-//! # let server = VerifiableServer::<Default>::new(&mut server_rng)
+//! # let server = VerifiableServer::<Group, Hash>::new(&mut server_rng)
 //! #   .expect("Unable to construct server");
 //! # let server_batch_evaluate_result = server.batch_evaluate(
 //! #     &mut server_rng,
 //! #     &client_messages,
-//! #     &Metadata::none(),
+//! #     None,
 //! # ).expect("Unable to perform server batch evaluate");
-//! let batch_finalize_input = BatchFinalizeInput::new(
-//!     client_states,
-//!     server_batch_evaluate_result.messages,
-//! );
 //! let client_batch_finalize_result = VerifiableClient::batch_finalize(
-//!     batch_finalize_input,
+//!     &client_states,
+//!     &server_batch_evaluate_result.messages,
 //!     server_batch_evaluate_result.proof,
 //!     server.get_public_key(),
-//!     &Metadata::none(),
+//!     None,
 //! ).expect("Unable to perform client batch finalization");
 //!
-//! println!("VOPRF batch outputs: {:?}", client_batch_finalize_result.outputs);
+//! println!("VOPRF batch outputs: {:?}", client_batch_finalize_result);
 //! ```
 //!
 //! ## Metadata
@@ -454,35 +391,45 @@
 //! This metadata can be constructed with some type of higher-level domain separation
 //! to avoid cross-protocol attacks or related issues.
 //!
-//! The default metadata simply consists of the empty vector of bytes, but a custom
-//! metadata can be specified, for example, by: `Metadata(b"custom metadata")`.
+//! A custom metadata can be specified, for example, by: `Some(b"custom metadata")`.
 //!
 //! # Features
 //!
-//! - The `p256` feature enables using p256 as the underlying group for the [CipherSuite] choice.
+//! - The `p256` feature enables using p256 as the underlying group for the [Group](group::Group) choice.
 //! Note that this is currently an experimental feature ⚠️, and is not yet ready for production use.
 //!
-//! - The `serialize` feature, enabled by default, provides convenience functions for serializing and deserializing with
+//! - The `serde` feature, enabled by default, provides convenience functions for serializing and deserializing with
 //! [serde](https://serde.rs/).
 //!
-//! - The `u32_backend` and `u64_backend` features are re-exported from
+//! - The `danger` feature, disabled by default, exposes functions for setting and getting
+//!   internal values not available in the default API. These functions are intended for use in
+//!   by higher-level cryptographic protocols that need access to these raw values and are able to
+//!   perform the necessary validations on them (such as being valid group elements).
+//!
+//! - The backend features are re-exported from
 //! [curve25519-dalek](https://doc.dalek.rs/curve25519_dalek/index.html#backends-and-features) and allow for selecting
-//! the corresponding backend for the curve arithmetic used. The `u64_backend` feature is included as the default.
+//! the corresponding backend for the curve arithmetic used. The `ristretto255_u64` feature is included as the default.
+//! Other features are mapped as `ristretto255_u32`, `ristretto255_fiat_u64` and `ristretto255_fiat_u32`.
+//!
+//! - The `ristretto255_simd` feature is re-exported from
+//! [curve25519-dalek](https://doc.dalek.rs/curve25519_dalek/index.html#backends-and-features) and enables parallel formulas,
+//! using either AVX2 or AVX512-IFMA. This will automatically enable the `ristretto255_u64` feature and requires Rust nightly.

-#![cfg_attr(not(feature = "bench"), deny(missing_docs))]
 #![deny(unsafe_code)]
+#![warn(clippy::cargo, missing_docs)]
+#![allow(clippy::multiple_crate_versions)]
 #![cfg_attr(not(feature = "std"), no_std)]
+#![cfg_attr(docsrs, feature(doc_cfg))]

 extern crate alloc;

 #[macro_use]
 mod impls;
 #[macro_use]
-mod serialization;
-mod ciphersuite;
+mod util;
 pub mod errors;
 pub mod group;
-pub mod hash;
+mod serialization;
 mod voprf;

 #[cfg(test)]
@@ -490,12 +437,8 @@ mod tests;

 // Exports

-pub use rand;
-
-pub use crate::ciphersuite::CipherSuite;
 pub use crate::voprf::{
-    BatchFinalizeInput, BlindedElement, EvaluationElement, Metadata, NonVerifiableClient,
-    NonVerifiableClientBlindResult, NonVerifiableClientFinalizeResult, NonVerifiableServer,
-    NonVerifiableServerEvaluateResult, VerifiableClient, VerifiableClientBlindResult,
-    VerifiableClientFinalizeResult, VerifiableServer, VerifiableServerEvaluateResult,
+    BlindedElement, EvaluationElement, NonVerifiableClient, NonVerifiableClientBlindResult,
+    NonVerifiableServer, NonVerifiableServerEvaluateResult, VerifiableClient,
+    VerifiableClientBlindResult, VerifiableServer, VerifiableServerEvaluateResult,
 };
@@ -9,7 +9,6 @@
 //! in the VOPRF protocol

 use crate::{
-    ciphersuite::CipherSuite,
    errors::InternalError,
    group::Group,
    voprf::{
@@ -18,138 +17,143 @@ use crate::{
    },
 };
 use alloc::vec::Vec;
-use generic_array::{typenum::Unsigned, GenericArray};
+use core::marker::PhantomData;
+use digest::{BlockInput, Digest};
+use generic_array::typenum::Unsigned;

 //////////////////////////////////////////////////////////
 // Serialization and Deserialization for High-Level API //
 // ==================================================== //
 //////////////////////////////////////////////////////////

-impl<CS: CipherSuite> NonVerifiableClient<CS> {
+impl<G: Group, H: BlockInput + Digest> NonVerifiableClient<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
-        [
-            CS::Group::scalar_as_bytes(self.blind).to_vec(),
-            self.data.clone(),
-        ]
-        .concat()
+        [G::scalar_as_bytes(self.blind).as_slice(), &self.data].concat()
    }

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
-        let scalar_len = <CS::Group as Group>::ScalarLen::USIZE;
+        let scalar_len = <G as Group>::ScalarLen::USIZE;
        if input.len() < scalar_len {
            return Err(InternalError::SizeError);
        }

-        let blind = CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?;
+        let blind = G::from_scalar_slice(&input[..scalar_len])?;
        let data = input[scalar_len..].to_vec();

-        Ok(Self { blind, data })
+        Ok(Self {
+            blind,
+            data,
+            hash: PhantomData,
+        })
    }
 }

-impl<CS: CipherSuite> VerifiableClient<CS> {
+impl<G: Group, H: BlockInput + Digest> VerifiableClient<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
        [
-            CS::Group::scalar_as_bytes(self.blind).to_vec(),
-            self.blinded_element.to_arr().to_vec(),
-            self.data.clone(),
+            G::scalar_as_bytes(self.blind).as_slice(),
+            &self.blinded_element.to_arr(),
+            &self.data,
        ]
        .concat()
    }

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
-        let scalar_len = <CS::Group as Group>::ScalarLen::USIZE;
-        let elem_len = <CS::Group as Group>::ElemLen::USIZE;
+        let scalar_len = <G as Group>::ScalarLen::USIZE;
+        let elem_len = <G as Group>::ElemLen::USIZE;
        if input.len() < scalar_len + elem_len {
            return Err(InternalError::SizeError);
        }

-        let blind = CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?;
-        let blinded_element = CS::Group::from_element_slice(GenericArray::from_slice(
-            &input[scalar_len..scalar_len + elem_len],
-        ))?;
+        let blind = G::from_scalar_slice(&input[..scalar_len])?;
+        let blinded_element = G::from_element_slice(&input[scalar_len..scalar_len + elem_len])?;
        let data = input[scalar_len + elem_len..].to_vec();

        Ok(Self {
            blind,
            blinded_element,
            data,
+            hash: PhantomData,
        })
    }
 }

-impl<CS: CipherSuite> NonVerifiableServer<CS> {
+impl<G: Group, H: BlockInput + Digest> NonVerifiableServer<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
-        CS::Group::scalar_as_bytes(self.sk).to_vec()
+        G::scalar_as_bytes(self.sk).to_vec()
    }

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
-        let scalar_len = <CS::Group as Group>::ScalarLen::USIZE;
+        let scalar_len = <G as Group>::ScalarLen::USIZE;
        if input.len() != scalar_len {
            return Err(InternalError::SizeError);
        }

-        let sk = CS::Group::from_scalar_slice(GenericArray::from_slice(input))?;
+        let sk = G::from_scalar_slice(input)?;

-        Ok(Self { sk })
+        Ok(Self {
+            sk,
+            hash: PhantomData,
+        })
    }
 }

-impl<CS: CipherSuite> VerifiableServer<CS> {
+impl<G: Group, H: BlockInput + Digest> VerifiableServer<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
-        [
-            CS::Group::scalar_as_bytes(self.sk).to_vec(),
-            self.pk.to_arr().to_vec(),
-        ]
-        .concat()
+        [G::scalar_as_bytes(self.sk).as_slice(), &self.pk.to_arr()].concat()
    }

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
-        let scalar_len = <CS::Group as Group>::ScalarLen::USIZE;
-        let elem_len = <CS::Group as Group>::ElemLen::USIZE;
+        let scalar_len = <G as Group>::ScalarLen::USIZE;
+        let elem_len = <G as Group>::ElemLen::USIZE;
        if input.len() != scalar_len + elem_len {
            return Err(InternalError::SizeError);
        }

-        let sk = CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?;
-        let pk = CS::Group::from_element_slice(GenericArray::from_slice(&input[scalar_len..]))?;
+        let sk = G::from_scalar_slice(&input[..scalar_len])?;
+        let pk = G::from_element_slice(&input[scalar_len..])?;

-        Ok(Self { sk, pk })
+        Ok(Self {
+            sk,
+            pk,
+            hash: PhantomData,
+        })
    }
 }

-impl<CS: CipherSuite> Proof<CS> {
+impl<G: Group, H: BlockInput + Digest> Proof<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
        [
-            CS::Group::scalar_as_bytes(self.c_scalar),
-            CS::Group::scalar_as_bytes(self.s_scalar),
+            G::scalar_as_bytes(self.c_scalar),
+            G::scalar_as_bytes(self.s_scalar),
        ]
        .concat()
    }

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
-        let scalar_len = <CS::Group as Group>::ScalarLen::USIZE;
-        if input.len() < scalar_len + scalar_len {
+        let scalar_len = <G as Group>::ScalarLen::USIZE;
+        if input.len() != scalar_len + scalar_len {
            return Err(InternalError::SizeError);
        }
        Ok(Proof {
-            c_scalar: CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?,
-            s_scalar: CS::Group::from_scalar_slice(GenericArray::from_slice(&input[scalar_len..]))?,
+            c_scalar: G::from_scalar_slice(&input[..scalar_len])?,
+            s_scalar: G::from_scalar_slice(&input[scalar_len..])?,
+            hash: PhantomData,
        })
    }
 }

-impl<CS: CipherSuite> BlindedElement<CS> {
+impl<G: Group, H: BlockInput + Digest> BlindedElement<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
        self.value.to_arr().to_vec()
@@ -157,13 +161,18 @@ impl<CS: CipherSuite> BlindedElement<CS> {

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
+        let elem_len = <G as Group>::ElemLen::USIZE;
+        if input.len() != elem_len {
+            return Err(InternalError::SizeError);
+        }
        Ok(Self {
-            value: CS::Group::from_element_slice(GenericArray::from_slice(input))?,
+            value: G::from_element_slice(input)?,
+            hash: PhantomData,
        })
    }
 }

-impl<CS: CipherSuite> EvaluationElement<CS> {
+impl<G: Group, H: BlockInput + Digest> EvaluationElement<G, H> {
    /// Serialization into bytes
    pub fn serialize(&self) -> Vec<u8> {
        self.value.to_arr().to_vec()
@@ -171,58 +180,13 @@ impl<CS: CipherSuite> EvaluationElement<CS> {

    /// Deserialization from bytes
    pub fn deserialize(input: &[u8]) -> Result<Self, InternalError> {
+        let elem_len = <G as Group>::ElemLen::USIZE;
+        if input.len() != elem_len {
+            return Err(InternalError::SizeError);
+        }
        Ok(Self {
-            value: CS::Group::from_element_slice(GenericArray::from_slice(input))?,
+            value: G::from_element_slice(input)?,
+            hash: PhantomData,
        })
    }
 }
-
-//////////////////////
-// Helper Functions //
-// ================ //
-//////////////////////
-
-// Corresponds to the I2OSP() function from RFC8017
-pub(crate) fn i2osp(input: usize, length: usize) -> Result<alloc::vec::Vec<u8>, InternalError> {
-    let sizeof_usize = core::mem::size_of::<usize>();
-
-    // Check if input >= 256^length
-    if (sizeof_usize as u32 - input.leading_zeros() / 8) > length as u32 {
-        return Err(InternalError::SerializationError);
-    }
-
-    if length <= sizeof_usize {
-        return Ok((&input.to_be_bytes()[sizeof_usize - length..]).to_vec());
-    }
-
-    let mut output = alloc::vec![0u8; length];
-    output.splice(
-        length - sizeof_usize..length,
-        input.to_be_bytes().iter().cloned(),
-    );
-    Ok(output)
-}
-
-// Computes I2OSP(len(input), max_bytes) || input
-pub(crate) fn serialize(input: &[u8], max_bytes: usize) -> Result<Vec<u8>, InternalError> {
-    Ok([&i2osp(input.len(), max_bytes)?, input].concat())
-}
-
-#[cfg(test)]
-mod unit_tests {
-    use super::*;
-
-    // Test the error condition for I2OSP
-    #[test]
-    fn test_i2osp_err_check() {
-        assert!(i2osp(0, 1).is_ok());
-
-        assert!(i2osp(255, 1).is_ok());
-        assert!(i2osp(256, 1).is_err());
-        assert!(i2osp(257, 1).is_err());
-
-        assert!(i2osp(256 * 256 - 1, 2).is_ok());
-        assert!(i2osp(256 * 256, 2).is_err());
-        assert!(i2osp(256 * 256 + 1, 2).is_err());
-    }
-}
@@ -7,7 +7,7 @@

 use alloc::vec::Vec;
 use core::cmp::min;
-use rand::{CryptoRng, Error, RngCore};
+use rand_core::{CryptoRng, Error, RngCore};

 /// A simple implementation of `RngCore` for testing purposes.
 ///
@@ -9,18 +9,3 @@ mod mock_rng;
 mod parser;
 mod voprf_test_vectors;
 mod voprf_vectors;
-
-/// Ciphersuite definitions for tests
-pub(crate) struct Ristretto255Sha512;
-impl crate::CipherSuite for Ristretto255Sha512 {
-    type Group = curve25519_dalek::ristretto::RistrettoPoint;
-    type Hash = sha2::Sha512;
-}
-
-#[cfg(feature = "p256")]
-pub(crate) struct P256Sha256;
-#[cfg(feature = "p256")]
-impl crate::CipherSuite for P256Sha256 {
-    type Group = p256_::ProjectivePoint;
-    type Hash = sha2::Sha256;
-}
@@ -85,7 +85,7 @@ fn parse_params(input: &str) -> String {
                // If line contains =, then
                if line.contains('=') {
                    // Clear out any existing string and flush to params
-                    if param.len() > 0 {
+                    if !param.is_empty() {
                        param += "\"";
                        params.push(param);
                    }
@@ -97,11 +97,11 @@ fn parse_params(input: &str) -> String {
                    param = format!("    \"{}\": \"{}", key, val);
                } else {
                    let s = line.trim().to_string();
-                    if s.contains("~") || s.contains("#") {
+                    if s.contains('~') || s.contains('#') {
                        // Ignore comment lines
                        continue;
                    }
-                    if s.len() > 0 {
+                    if !s.is_empty() {
                        param += &s;
                    }
                }
@@ -6,17 +6,17 @@
 // of this source tree.

 use crate::{
-    ciphersuite::CipherSuite,
    errors::InternalError,
    group::Group,
    tests::{mock_rng::CycleRng, parser::*},
    voprf::{
-        BatchFinalizeInput, BlindedElement, EvaluationElement, Metadata, NonVerifiableClient,
-        NonVerifiableServer, Proof, VerifiableClient, VerifiableServer,
+        BlindedElement, EvaluationElement, NonVerifiableClient, NonVerifiableServer, Proof,
+        VerifiableClient, VerifiableServer,
    },
 };
 use alloc::string::ToString;
 use alloc::vec::Vec;
+use digest::{BlockInput, Digest};
 use generic_array::GenericArray;
 use json::JsonValue;

@@ -40,14 +40,14 @@ fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters {
        seed: decode(values, "seed"),
        sksm: decode(values, "skSm"),
        pksm: decode(values, "pkSm"),
-        input: decode_vec(&values, "Input"),
+        input: decode_vec(values, "Input"),
        info: decode(values, "Info"),
-        blind: decode_vec(&values, "Blind"),
-        blinded_element: decode_vec(&values, "BlindedElement"),
-        evaluation_element: decode_vec(&values, "EvaluationElement"),
+        blind: decode_vec(values, "Blind"),
+        blinded_element: decode_vec(values, "BlindedElement"),
+        evaluation_element: decode_vec(values, "EvaluationElement"),
        proof: decode(values, "Proof"),
        proof_random_scalar: decode(values, "ProofRandomScalar"),
-        output: decode_vec(&values, "Output"),
+        output: decode_vec(values, "Output"),
    }
 }

@@ -55,7 +55,7 @@ fn decode(values: &JsonValue, key: &str) -> Vec<u8> {
    values[key]
        .as_str()
        .and_then(|s| hex::decode(&s.to_string()).ok())
-        .unwrap_or(vec![])
+        .unwrap_or_default()
 }

 fn decode_vec(values: &JsonValue, key: &str) -> Vec<Vec<u8>> {
@@ -85,7 +85,8 @@ fn test_vectors() -> Result<(), InternalError> {
    let rfc = json::parse(rfc_to_json(super::voprf_vectors::VECTORS).as_str())
        .expect("Could not parse json");

-    use crate::tests::Ristretto255Sha512;
+    use curve25519_dalek::ristretto::RistrettoPoint;
+    use sha2::Sha512;

    let ristretto_base_tvs = json_to_test_vectors!(
        rfc,
@@ -99,19 +100,20 @@ fn test_vectors() -> Result<(), InternalError> {
        String::from("Verifiable")
    );

-    test_base_seed_to_key::<Ristretto255Sha512>(&ristretto_base_tvs)?;
-    test_base_blind::<Ristretto255Sha512>(&ristretto_base_tvs)?;
-    test_base_evaluate::<Ristretto255Sha512>(&ristretto_base_tvs)?;
-    test_base_finalize::<Ristretto255Sha512>(&ristretto_base_tvs)?;
+    test_base_seed_to_key::<RistrettoPoint, Sha512>(&ristretto_base_tvs)?;
+    test_base_blind::<RistrettoPoint, Sha512>(&ristretto_base_tvs)?;
+    test_base_evaluate::<RistrettoPoint, Sha512>(&ristretto_base_tvs)?;
+    test_base_finalize::<RistrettoPoint, Sha512>(&ristretto_base_tvs)?;

-    test_verifiable_seed_to_key::<Ristretto255Sha512>(&ristretto_verifiable_tvs)?;
-    test_verifiable_blind::<Ristretto255Sha512>(&ristretto_verifiable_tvs)?;
-    test_verifiable_evaluate::<Ristretto255Sha512>(&ristretto_verifiable_tvs)?;
-    test_verifiable_finalize::<Ristretto255Sha512>(&ristretto_verifiable_tvs)?;
+    test_verifiable_seed_to_key::<RistrettoPoint, Sha512>(&ristretto_verifiable_tvs)?;
+    test_verifiable_blind::<RistrettoPoint, Sha512>(&ristretto_verifiable_tvs)?;
+    test_verifiable_evaluate::<RistrettoPoint, Sha512>(&ristretto_verifiable_tvs)?;
+    test_verifiable_finalize::<RistrettoPoint, Sha512>(&ristretto_verifiable_tvs)?;

    #[cfg(feature = "p256")]
    {
-        use crate::tests::P256Sha256;
+        use p256_::ProjectivePoint;
+        use sha2::Sha256;

        let p256_base_tvs =
            json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("Base"));
@@ -122,43 +124,43 @@ fn test_vectors() -> Result<(), InternalError> {
            String::from("Verifiable")
        );

-        test_base_seed_to_key::<P256Sha256>(&p256_base_tvs)?;
-        test_base_blind::<P256Sha256>(&p256_base_tvs)?;
-        test_base_evaluate::<P256Sha256>(&p256_base_tvs)?;
-        test_base_finalize::<P256Sha256>(&p256_base_tvs)?;
+        test_base_seed_to_key::<ProjectivePoint, Sha256>(&p256_base_tvs)?;
+        test_base_blind::<ProjectivePoint, Sha256>(&p256_base_tvs)?;
+        test_base_evaluate::<ProjectivePoint, Sha256>(&p256_base_tvs)?;
+        test_base_finalize::<ProjectivePoint, Sha256>(&p256_base_tvs)?;

-        test_verifiable_seed_to_key::<P256Sha256>(&p256_verifiable_tvs)?;
-        test_verifiable_blind::<P256Sha256>(&p256_verifiable_tvs)?;
-        test_verifiable_evaluate::<P256Sha256>(&p256_verifiable_tvs)?;
-        test_verifiable_finalize::<P256Sha256>(&p256_verifiable_tvs)?;
+        test_verifiable_seed_to_key::<ProjectivePoint, Sha256>(&p256_verifiable_tvs)?;
+        test_verifiable_blind::<ProjectivePoint, Sha256>(&p256_verifiable_tvs)?;
+        test_verifiable_evaluate::<ProjectivePoint, Sha256>(&p256_verifiable_tvs)?;
+        test_verifiable_finalize::<ProjectivePoint, Sha256>(&p256_verifiable_tvs)?;
    }

    Ok(())
 }

-fn test_base_seed_to_key<CS: CipherSuite>(
+fn test_base_seed_to_key<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
-        let server = NonVerifiableServer::<CS>::new_from_seed(&parameters.seed)?;
+        let server = NonVerifiableServer::<G, H>::new_from_seed(&parameters.seed)?;

        assert_eq!(
            &parameters.sksm,
-            &CS::Group::scalar_as_bytes(server.get_private_key()).to_vec()
+            &G::scalar_as_bytes(server.get_private_key()).to_vec()
        );
    }
    Ok(())
 }

-fn test_verifiable_seed_to_key<CS: CipherSuite>(
+fn test_verifiable_seed_to_key<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
-        let server = VerifiableServer::<CS>::new_from_seed(&parameters.seed)?;
+        let server = VerifiableServer::<G, H>::new_from_seed(&parameters.seed)?;

        assert_eq!(
            &parameters.sksm,
-            &CS::Group::scalar_as_bytes(server.get_private_key()).to_vec()
+            &G::scalar_as_bytes(server.get_private_key()).to_vec()
        );
        assert_eq!(&parameters.pksm, &server.get_public_key().to_arr().to_vec());
    }
@@ -166,17 +168,21 @@ fn test_verifiable_seed_to_key<CS: CipherSuite>(
 }

 // Tests input -> blind, blinded_element
-fn test_base_blind<CS: CipherSuite>(
+fn test_base_blind<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
        for i in 0..parameters.input.len() {
-            let mut rng = CycleRng::new(parameters.blind[i].to_vec());
-            let client_result = NonVerifiableClient::<CS>::blind(&parameters.input[i], &mut rng)?;
+            let blind =
+                G::from_scalar_slice(&GenericArray::clone_from_slice(&parameters.blind[i]))?;
+            let client_result = NonVerifiableClient::<G, H>::deterministic_blind_unchecked(
+                parameters.input[i].clone(),
+                blind,
+            )?;

            assert_eq!(
                &parameters.blind[i],
-                &CS::Group::scalar_as_bytes(client_result.state.get_blind()).to_vec()
+                &G::scalar_as_bytes(client_result.state.get_blind()).to_vec()
            );
            assert_eq!(
                &parameters.blinded_element[i],
@@ -188,18 +194,21 @@ fn test_base_blind<CS: CipherSuite>(
 }

 // Tests input -> blind, blinded_element
-fn test_verifiable_blind<CS: CipherSuite>(
+fn test_verifiable_blind<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
        for i in 0..parameters.input.len() {
-            let mut rng = CycleRng::new(parameters.blind[i].to_vec());
-            let client_blind_result =
-                VerifiableClient::<CS>::blind(&parameters.input[i], &mut rng)?;
+            let blind =
+                G::from_scalar_slice(&GenericArray::clone_from_slice(&parameters.blind[i]))?;
+            let client_blind_result = VerifiableClient::<G, H>::deterministic_blind_unchecked(
+                parameters.input[i].clone(),
+                blind,
+            )?;

            assert_eq!(
                &parameters.blind[i],
-                &CS::Group::scalar_as_bytes(client_blind_result.state.get_blind()).to_vec()
+                &G::scalar_as_bytes(client_blind_result.state.get_blind()).to_vec()
            );
            assert_eq!(
                &parameters.blinded_element[i],
@@ -211,15 +220,15 @@ fn test_verifiable_blind<CS: CipherSuite>(
 }

 // Tests sksm, blinded_element -> evaluation_element
-fn test_base_evaluate<CS: CipherSuite>(
+fn test_base_evaluate<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
        for i in 0..parameters.input.len() {
-            let server = NonVerifiableServer::<CS>::new_with_key(&parameters.sksm)?;
+            let server = NonVerifiableServer::<G, H>::new_with_key(&parameters.sksm)?;
            let server_result = server.evaluate(
                BlindedElement::deserialize(&parameters.blinded_element[i])?,
-                &Metadata(parameters.info.clone()),
+                Some(&parameters.info),
            )?;

            assert_eq!(
@@ -231,23 +240,20 @@ fn test_base_evaluate<CS: CipherSuite>(
    Ok(())
 }

-fn test_verifiable_evaluate<CS: CipherSuite>(
+fn test_verifiable_evaluate<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
        let mut rng = CycleRng::new(parameters.proof_random_scalar.clone());
-        let server = VerifiableServer::<CS>::new_with_key(&parameters.sksm)?;
+        let server = VerifiableServer::<G, H>::new_with_key(&parameters.sksm)?;

        let mut blinded_elements = vec![];
        for blinded_element_bytes in &parameters.blinded_element {
-            blinded_elements.push(BlindedElement::deserialize(&blinded_element_bytes)?);
+            blinded_elements.push(BlindedElement::deserialize(blinded_element_bytes)?);
        }

-        let batch_evaluate_result = server.batch_evaluate(
-            &mut rng,
-            &blinded_elements,
-            &Metadata(parameters.info.clone()),
-        )?;
+        let batch_evaluate_result =
+            server.batch_evaluate(&mut rng, &blinded_elements, Some(&parameters.info))?;

        for i in 0..parameters.evaluation_element.len() {
            assert_eq!(
@@ -262,70 +268,64 @@ fn test_verifiable_evaluate<CS: CipherSuite>(
 }

 // Tests input, blind, evaluation_element -> output
-fn test_base_finalize<CS: CipherSuite>(
+fn test_base_finalize<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
        for i in 0..parameters.input.len() {
-            let client = NonVerifiableClient::<CS>::from_data_and_blind(
+            let client = NonVerifiableClient::<G, H>::from_data_and_blind(
                &parameters.input[i],
-                &<CS::Group as Group>::from_scalar_slice(&GenericArray::clone_from_slice(
+                <G as Group>::from_scalar_slice(&GenericArray::clone_from_slice(
                    &parameters.blind[i],
                ))?,
            );

            let client_finalize_result = client.finalize(
                EvaluationElement::deserialize(&parameters.evaluation_element[i])?,
-                &Metadata(parameters.info.clone()),
+                Some(&parameters.info),
            )?;

-            assert_eq!(
-                &parameters.output[i],
-                &client_finalize_result.output.to_vec()
-            );
+            assert_eq!(&parameters.output[i], &client_finalize_result.to_vec());
        }
    }
    Ok(())
 }

-fn test_verifiable_finalize<CS: CipherSuite>(
+fn test_verifiable_finalize<G: Group, H: BlockInput + Digest>(
    tvs: &[VOPRFTestVectorParameters],
 ) -> Result<(), InternalError> {
    for parameters in tvs {
        let mut clients = vec![];
        for i in 0..parameters.input.len() {
-            let client = VerifiableClient::<CS>::from_data_and_blind(
+            let client = VerifiableClient::<G, H>::from_data_and_blind_and_element(
                &parameters.input[i],
-                &<CS::Group as Group>::from_scalar_slice(&GenericArray::clone_from_slice(
+                <G as Group>::from_scalar_slice(&GenericArray::clone_from_slice(
                    &parameters.blind[i],
                ))?,
-                &<CS::Group as Group>::from_element_slice(&GenericArray::clone_from_slice(
+                <G as Group>::from_element_slice(&GenericArray::clone_from_slice(
                    &parameters.blinded_element[i],
                ))?,
            );
            clients.push(client.clone());
        }

-        let batch_finalize_input = BatchFinalizeInput::new(
-            clients,
-            parameters
-                .evaluation_element
-                .iter()
-                .map(|x| EvaluationElement::deserialize(x).unwrap())
-                .collect(),
-        );
+        let messages: Vec<_> = parameters
+            .evaluation_element
+            .iter()
+            .map(|x| EvaluationElement::deserialize(x).unwrap())
+            .collect();

        let batch_result = VerifiableClient::batch_finalize(
-            batch_finalize_input,
+            &clients,
+            &messages,
            Proof::deserialize(&parameters.proof)?,
-            CS::Group::from_element_slice(GenericArray::from_slice(&parameters.pksm))?,
-            &Metadata(parameters.info.clone()),
+            G::from_element_slice(GenericArray::from_slice(&parameters.pksm))?,
+            Some(&parameters.info),
        )?;

        assert_eq!(
            parameters.output,
            batch_result
-                .outputs
                .iter()
                .map(|arr| arr.to_vec())
                .collect::<Vec<Vec<u8>>>()
@@ -16,8 +16,8 @@ pub(crate) static VECTORS: &str = r#"
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1
-701
+skSm = 74db8e13d2c5148a1181d57cc06debd730da4df1978b72ac18bc48992a0d2
+c0f
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -27,13 +27,13 @@ Input = 00
 Info = 7465737420696e666f
 Blind = c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf
 8e03
-BlindedElement = fc20e03aff3a9de9b37e8d35886ade11ec7d85c2a1fb5bb0b16
-86c64e07ac467
-EvaluationElement = 922e4c04b9f3b3e795d322a306c0ab9d96b667df9b949c05
-2c8c75435a9dbf2f
-Output = 9e857d0e8523b8eb9e995d455ae6ae19f75d85ac8b5df62c50616fb5aa0
-ced3da5646698089c36dead28f9ad8e489fc0ee1c8e168725c38ed50f3783a5c520c
-e
+BlindedElement = 744441a5d3ee12571a84d34812443eba2b6521a47265ad655f0
+1e759b3dd7d35
+EvaluationElement = 4254c503ee2013262473eec926b109b018d699b8dd954ee8
+78bc17b159696353
+Output = 9aef8983b729baacb7ecf1be98d1276ca29e7d62dbf39bc595be018b66b
+199119f18579a9ae96a39d7d506c9e00f75b433a870d76ba755a3e7196911fff89ff
+3
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -43,13 +43,13 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037
 e50b
-BlindedElement = 483d4f39de5ff77fa0f9a0ad2334dd5bf87f2cda868539d21de
-67ce49e7d1536
-EvaluationElement = 6eef6ee53c6fb17c77ae47e78bdca2e1094f98785e7b9a14
-f09be20797dad656
-Output = b090b2ff80028771c14fecf2f37c1b14e46deec59c83d3b943c51d315bd
-3bf7d32c399ed0c4ce6003339ab9ed4ad168bfb595e43530c9d73ff02ab0f1263d93
-b
+BlindedElement = f4eeea4e1bcb2ec818ee2d5c1fcec56c24064a9ff4bea5b3dd6
+877800fc28e4d
+EvaluationElement = 185dae43b6209dacbc41a62fd4889700d11eeeff4e83ffbc
+72d54daee7e25659
+Output = f556e2d83e576b4edc890472572d08f0d90d2ecc52a73b35b2a8416a72f
+f676549e3a83054fdf4fd16fe03e03bee7bb32cbd83c7ca212ea0d03b8996c2c268b
+2
 ~~~

 ### Verifiable Mode
@@ -57,10 +57,10 @@ b
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = ac37d5850510299406ea8eb8fa226a7bfc2467a4b070d6c7bf667948b9600
-b00
-pkSm = 0c0254e22063cae3e1bae02fb6fa20882664a117c0278eda6bda3372c0dd9
-860
+skSm = ad08ad9c7107691d792d346d743e8a79b8f6ae0673d58cbf7389d7003598c
+903
+pkSm = 7a5627aec2f2209a2fc62f39f57a8f5ffc4bbfd679d0273e6081b2b621ee3
+b52
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -70,17 +70,17 @@ Input = 00
 Info = 7465737420696e666f
 Blind = ed8366feb6b1d05d1f46acb727061e43aadfafe9c10e5a64e7518d63e326
 3503
-BlindedElement = 3a0a53f2c57e5ee0d89e394087f8e5f95b24159db01c31933a0
-7f0e6414c954d
-EvaluationElement = f8a50ed35a477b0cde91d926e1bc5ae59b97d5bd0dda51a7
-28b0f036ec557d79
-Proof = 7a5375eb1dbad259431f5c294e816a1c1483c279748da1a75d91f8a81438
-ea08355d4087d4d848b46878dcc8fb5849ac7a09133382c2c6129564a7f7b4b7bf01
+BlindedElement = 56c6926e940df23d5dfe6a48949c5a9e5b503df3bff36454ba4
+821afa1528718
+EvaluationElement = 523774950001072a4fb1f1f3300f7feb1eeddb5b8304baa9
+c3d463c11e7f0509
+Proof = c973c8cfbcdbb12a09e7640e44e45d85d420ed0539a18dc6c67c189b4f28
+c70dd32f9b13717ee073e1e73333a7cb17545dd42ed8a2008c5dae11a3bd7e70260d
 ProofRandomScalar = 019cbd1d7420292528f8cdd62f339fdabb602f04a95dac9d
 bcec831b8c681a09
-Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d
-eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1
-a
+Output = 2d9ed987fdfa623a5b4d5e445b127e86212b7c8f2567c175b424c59602f
+bba7c36975df5e4ecdf060430c8b1b581fc97e953535fd82089e15afbafcf310b339
+9
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -90,16 +90,16 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = e6d0f1d89ad552e383d6c6f4e8598cc3037d6e274d22da3089e7afbd4171
 ea02
-BlindedElement = a86dd4544d0f3ea973926054230767dff16016215f2d73f26d3
-f86a81f38cf1a
-EvaluationElement = 9e47810f1de1b57ebe163a95c170ec165a2063f872155c37
-6d94e8de2157af70
-Proof = 61075125d851d5164b0aa1a4d5ddeebaf097266450ac6019579af5f7abd1
-90088eb0f6f1e7f9d8bfddbc21ae3c25a065e6c4e797d15f345ed4fb9ee468d24c0a
+BlindedElement = 5cd133d03df2e1ff919ed85501319c2039853dd7dc59da73605
+fd5791b835d23
+EvaluationElement = c0ba1012cbfb0338dadb435ef1d910eb179dc18c0d0a341f
+0249a3a9ff03b06e
+Proof = 156761aee4eb6a5e1e32bc0adb56ea46d65883777e152d4c607a3a3b8abf
+3b036ecebae005d3f26222a8da0a3924cceed8a1a7c707ef4ba077456c3e80f8c40f
 ProofRandomScalar = 74ae06fd50d5f26c2519bd7b184f45dd3ef2cb50197d42df
 9d013f7d6c312a0b
-Output = fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f2
-18047d1fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0
+Output = f5da1276b5ca3de4591534cf2d96f7bb49059bd374f40259f42dca89d72
+3cac69ed3ae567128aaa2dfdf777f333615524aec24bc77b0a38e200e6a07b6c638e
 b
 ~~~

@@ -111,20 +111,20 @@ Info = 7465737420696e666f
 Blind = 80513e77795feeec6d2c450589b0e1b178febd5c193a9fcba0d27f0a06e0
 d50f,533c2e6d91c934f919ac218973be55ba0d7b234160a0d4cf3bddafbda99e2e0
 c
-BlindedElement = c24645d6378a4a86ec4682a8d86f368b1e7db870fd709a45102
-492bcdc17e904,0e5ec78f839a8b6e86999bc180602690a4daae57bf5d7f827f3d40
-2f56cc6c51
-EvaluationElement = 3afe48eab00493eb1b073e95f57a456cde9aefe463dd1e6d
-0144bf6e99ce411c,daaf9421318fd2c7fcdf369cb348748cf4dd177cce30ee4d13c
-eb1644b85b653
-Proof = 601381ecbe127ada04c057b8b1fc21d912f71e49252780dd0d0ac768b233
-ce035f9b489a994c1d14b92d603ebcffee4f5cfadc953f69bb62648c6e662613ae00
+BlindedElement = 1c7ee9c1b4145dabeba9ad159531432a20718cb44a86f79dc73
+f6f8671c9bf5e,7c1ef37881602cb6d3cf995e6ee310ed51e39b80ce0a825a316bc6
+21d0580a14
+EvaluationElement = a8a66348d351408cb7e2d26341a1258ba91c1a7d1b380f62
+15bdfc242500991b,5a4b72bee9d2ca80ea220571690e2f92fadd0c13635b2888bc1
+ff255f8fee975
+Proof = caad28bac17ce71d59b43956e8d80f3edde3d0c317144bef3d10d9733ef1
+cf09fd910c663ea85ad7cfaf641d73314694fe18d3f6b89cfe001b18163ff908d10a
 ProofRandomScalar = 3af5aec325791592eee4a8860522f8444c8e71ac33af5186
 a9706137886dce08
-Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d
-eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1
-a,fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f218047d1
-fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0b
+Output = 2d9ed987fdfa623a5b4d5e445b127e86212b7c8f2567c175b424c59602f
+bba7c36975df5e4ecdf060430c8b1b581fc97e953535fd82089e15afbafcf310b339
+9,f5da1276b5ca3de4591534cf2d96f7bb49059bd374f40259f42dca89d723cac69e
+d3ae567128aaa2dfdf777f333615524aec24bc77b0a38e200e6a07b6c638eb
 ~~~

 ## OPRF(decaf448, SHAKE-256)
@@ -134,8 +134,8 @@ fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0b
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = 78f2622804104209f7e015370ff98f4a3cbf311e6784e9f4944f8a252dc08
-e916d9ab1a60dc905f0e56631903ecd4ae6e15291776d61460b
+skSm = 82c2a6492e1792e6ccdf1d7cff410c717681bd53ad47da7646b14ebd05885
+53e4c034e02b3ae5e724600a17a638ad528c04f793df56c2618
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -145,13 +145,13 @@ Input = 00
 Info = 7465737420696e666f
 Blind = d1080372f0fcf8c5eace50914e7127f576725f215cc7c111673c635ce668
 bbbb9b50601ad89b358ab8c23ed0b6c9d040365ec9d060868714
-BlindedElement = 984e0a443ee194090737df4afb402253f216b77650c91d252b6
-638e1179723d51a4154b88eae396f1320f5df3c4b17f779516c456e364bd1
-EvaluationElement = de477252a5ff3c7d51ce159cb8ccf1865d8c7d3402824163
-8d80971f13a59d87b2b1036341b98089555ab088278391794c49bbb052fdbcff
-Output = df8f910c3b84d1f3ca6afd1992768608a20f2ad7b770e9d89d303c88ba1
-5bb7d991f2f7ffd5b5b51fa3bcf8fa06779609497f6c0ae4e9cb2dcd48c68b4ac6b9
-4
+BlindedElement = 1c354d6d31500c7c5ae6fb10901ac87552ea3af1824e79871e2
+596ef537f86abac64859cf6f35911ab74f0b09a06ecc757a65a104e9e49fb
+EvaluationElement = 9e5bbf27b2312a493b2f2f1d051b7cdf3801769ec5dc0724
+51b68c4d0d4ed9303979ec4798261a01fabd8d25540f48a11dd8342fded95383
+Output = 5f8c28d5e760786cbd000ac58444bd216141472b9370b058408a714da5e
+3dd51fc572f96c99a9338bc8569abc991bc1523fa1467cd3a0de3aef7f154bd65d92
+e
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -161,13 +161,13 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = aed1ffa44fd8f0ed16373606a3cf7df589cca86d8ea1abbf5768771dbef3
 d401c74ae55ba1e28b9565e1e4018eb261a14134a4ce60c1c718
-BlindedElement = 4aa751f84b2634b73efa364b03e60b92b84f457576e6b369eea
-b76140e3859d10d2e98174f13f5a2c70670529ccf093d5f1aaf355b4f830b
-EvaluationElement = 085ea1cb452a2fb15b3a0d0e1c86899c7ea49fe2e4856ef4
-f95bc2542eec610fc09b0fe7d7ed7389d86af6a646695b7ad46527dc2a936aa4
-Output = b57516a737879ece1110ad5d051ac0a6c54e1dcd989c907721ecebab5b4
-5877cc693c3c05d0bd416c5a9ceba36de41a0a31679c146fe4c110c64b056eba1720
-b
+BlindedElement = e8111f22d50595f68f01a6a9135f50e8702c90794c2637fbe00
+9046f0c455884cc77ee7a87f3abf494afe780b3620ab0e7fb65c65ba902b2
+EvaluationElement = 0ec625f99914ba702f0e6bc5d0f837cb4deaf7ab3ac55458
+7182c3dfe1dad6d1540964f9581d26e8ef0a47b61c5f145109a5fffe04ad528e
+Output = 7f0e40c08d8220f88c0961925f764ee0e4e08909d497f462a97a2030b40
+b44986fa76d344efb9b0acab23db81356fc8c380b80701a61a5fa76097a5d2ea7aa9
+e
 ~~~

 ### Verifiable Mode
@@ -175,10 +175,10 @@ b
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = 9eb722f7fee9f61f24ad31bc42309f73648cf4393929e8f5f333fe10c6975
-c827a1eba4e03ae2fa8735db2f63f6c98c7af6010e64c81f535
-pkSm = b6e2751176d57836fe1dfbdbbdc78a1b5c5a52f831226c9d8dfdf5daf8f46
-6e310e80978e9b81c387f5bc85cc7ef5567f4dd3ba7674579a2
+skSm = 5d295b55d1d6e46411bbb4151d154dc61711012ff2390255b3345988f8e3c
+458089d52e9b1d837049898f9e4e63a4534f0ed3b3a47c7051c
+pkSm = 8e623ef9b65ef2ce148ce56249ee5e69ed6acd3e504a07905cc4c09312551
+8d30ae7d6de274438b822d5a55a4365216ac588a4c400fbf6ff
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -188,19 +188,19 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 4c936db1779a621b6c71475ac3111fd5703a59b713929f36dfd1e892a7fe
 814479c93d8b4b6e11d1f6fe5351e51457b665fa7b76074e531f
-BlindedElement = d0b8e2eecad2816d45c1f8a072fe6db77d18f4b26f0889c98e2
-ef856ac5df82090c1fbeac9c8e732f192b66c3b4c3f1e446ab8910c86be2f
-EvaluationElement = d29849d8ad1e651328e8119003debd9ecd54cc786a5eb8ae
-ea56487ffc09120e98792f9475605488d16623b8e3cfa5af1ec27e76bc841b75
-Proof = 8b3b8f0c9eb22527e419f5a03d4d3f34cf725837424a38c5b4f88c7759f7
-a54bade57b7930bfeff051be9bfeaabc8976ed407398e0ce462a062e068a8d57bc1c
-411bc42fe714626cfb92ad854a56636c2b83f2b5215c2ff531b22e4d37031523db20
-3556959e275b46b84303ed23fc37
+BlindedElement = 74bb2406b15a86ba94b0686901545f8ddc23e64918de47c76fa
+0bf812387021392c73e01068ac9cc07c7647b3d0d4e648c27bb3880ddb8e5
+EvaluationElement = 90997b495c19f16561a3286a7bcba9a4ee6e12bab4d580d5
+004ae5064d90a389124e81066f3f1dbf9a729ab46ed674c3292f56d54a0d5641
+Proof = 668f6ef88b249d51b6c94bfe82f2bec35ab7386bc9f3d14209d0247a5b6e
+bedec4c333947fff96d322f516f4674cc07638b8e854c52be7045d83d65aff518104
+60ec43417a6c6efbfb67ba7b0257b1237c64e6792195e338474d09df32b076c0b702
+ec8c639b34c29878b87aad70d63c
 ProofRandomScalar = 1b3f5a55b2f18f8c53d4ecf2e1c27e1028f1c345bb504486
 4aa9dd8439d7520a7ba6183d50ef08bdf6c781aa465660c93e8195a8d231b62f
-Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93
-9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153
-d
+Output = 7db8c49354861f2d71c8175681c9cc930a00251330b2acc5c321f9833fe
+d4113a1cb3e05a3840082c24e8d49470474dd1c7586f3663f32f66dc3888c63dc0e6
+e
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -210,19 +210,19 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 15b3355179392f40c3d5a15f0d5ffc354e340454ec779f575e4573a3886a
 b5e57e4da2985cea9e32f6d95539ce2c7189e1bd7462e8c5483a
-BlindedElement = 0e7ddd85c8bc5382e908241c6151afe23a41e0396759b5e38a9
-affd996cd822bca242a499793555fc15f07bffdaaa93b42568b307fbdca0f
-EvaluationElement = 4c81e29e8a9502fa02e00cb09cf40d9b98988ac9b4bce7cc
-a0656caeb0926b59c7000d7fe6c5dd814f831864547d2360d223a50077bd04fe
-Proof = 74fc8fbf2e669dc5d25898ea8ce45d1d3eb97edb4b7c3cee39865a3c66da
-6b7bad4ad3e77794d6f5e82fa8a645b9b973a8612bfcd1194302f700ee3433e876d8
-3f96bb70f19ff292605ad4c9466fd71dbc2ed22ade0130574e5ee343ef45d42e834a
-11a19fd6f5b1b5ef910bcccf731b
+BlindedElement = ea3418614d71144ac4ecbd2c63c30ce34718b739ba0a5dd3585
+efd9800b9debdad4cffc25dcc39b4691aaffba19ead8a425d7d50f016f57e
+EvaluationElement = 7e12ab491c3787a1f17118f7a0308f8c41f4cd6e850cf7fa
+ba030b6c1bf1888337149e7c2fc88068626a0107be18e8b9e29f41c8d1510049
+Proof = 91ed184bf518a155749a99d39bed3f9dc9895054e55fab0ebd0ce4270e84
+52fcc8da055e8c2f75f2306ecacaa594de592e0d0b059b8eb30e15d5c3132b71ebc4
+933596c563ee8ce8681e0e40534e92ce487a0e33e341f02a9aaa1f750d9efa7545a0
+008b2f8dde5047ce68d00c2e962e
 ProofRandomScalar = 2f2e9955be83a4b25743ebd3618d4fad8b7288477da50bed
 9befa58af639ddd950fec34205f8a4f166fadcb8fa71a3ffdd2e98f4c8ef5e26
-Output = 2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c
-07f59055e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f
-9
+Output = 66125718c5d651c88ab57dda67c52a506d436600f1521b7684c869b9a2b
+3e67d1b41c47593e79fd6b70aaae8d3689536897ae8964ffcd433c0884c12c94929d
+c
 ~~~

 #### Test Vector 3, Batch Size 2
@@ -234,24 +234,24 @@ Blind = 614bb578f29cc677ea9e7aea3e4839413997e020f9377b63c13584156a09
 a46dd2a425c41eac0e313a47e99d05df72c6e1d58e6592577a0d,4c115060bca87db
 7d73e00cbb8559f84cb7a221b235b0950a0ab553f03f10e1386abe954011b7da62bb
 6599418ef90b5d4ea98cc28aff517
-BlindedElement = 5e481a4d7eaa5bab831f53f9a6311851dafd4318c6462eed4f6
-15004afdb082da2f99670b0963985faac21c30eea19aacfc441412edb4c0b,8e043b
-9b7afeafa07e39d9b8b88957ff07d69124b1a2b841e18c9ffb52ebf0c25144eb2501
-a1d7983a44604f33a36e925eebc9bec65d9c54
-EvaluationElement = 8a0d34fdb0b55121421546ff952c7bd3cbe469926ff9ad4f
-aeba243823955529eeae4f1a7a64cd055ec01baa041a99dfbe1a67ca4d59f93d,5e8
-6e0b41cc88186ee0003baa46535e71acd98453b298976b92be2cca2646e88620f55d
-f6bf4754456dfd8d84f6889c17b5ff93052325a1a
-Proof = 1ff624a102b99771c76a9414e9b3f33127897d971bc84a922e464805e4a9
-f27b889922030adebbbd58e0ab618ade9c84bfe8aa226176f11f432958ea1e6f6926
-3aef51db9efb23ee504d233c17e9077c0373401da167637a1df4eafd9c2537c9f89c
-103f9e635931fe2042419dd9bd37
+BlindedElement = 909b0b8bcb900bd9e70f27258d7264015c50f3717361afff22d
+16ad84758d2c6b7a1963263d0d035f63b88df8b473f9365c53abcec34b201,726315
+ee47e217344da7036a24f806177e221c9f6eae5763f9089b16bada69b85aec56c3ca
+83b6f5f1091640ea3fe3e9429ff2aa7772efef
+EvaluationElement = 46d8dec85a27698b4b69a67299eab1da0ec2bbed013a3a59
+b932e2938e2e2c5bcc8274febf49b7903419c18b895f17c4a9a504737d7a3fdc,fe4
+7eca9d06b400c80cc2b749284312c6f97c7b5d88055fe56b068c441e053fe909c6c2
+2bb7cd646a932e2d3838b7b3e2e883cfe0ed1a2a1
+Proof = 1f63637de4f945f5937ac015a508420f119f7b6a8e001439a1923a1705ce
+ee704ad17664ff4c72f89566f83ceccee3001d44d849ac4dad2bc05b9bc718ba787f
+c3c5b09198c4ab244455bac64a9a231b18c4682c0e6e30ae5398f5c041ee2c5b02c6
+19b7497c5bf070fdb4656353de1d
 ProofRandomScalar = a614f1894bcf6a1c7cef33909b794fe6e69a642b20f4c911
 8febffaf6b6a31471fe7794aa77ced123f07e56cc27de60b0ab106c0b8eab127
-Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93
-9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153
-d,2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c07f5905
-5e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f9
+Output = 7db8c49354861f2d71c8175681c9cc930a00251330b2acc5c321f9833fe
+d4113a1cb3e05a3840082c24e8d49470474dd1c7586f3663f32f66dc3888c63dc0e6
+e,66125718c5d651c88ab57dda67c52a506d436600f1521b7684c869b9a2b3e67d1b
+41c47593e79fd6b70aaae8d3689536897ae8964ffcd433c0884c12c94929dc
 ~~~

 ## OPRF(P-256, SHA-256)
@@ -261,8 +261,8 @@ d,2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c07f5905
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a78
-27b
+skSm = c15d9e9ab36d495d9d62954db6aafe06d3edabf41600d58f9be0737af2719
+e97
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -272,12 +272,12 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 5d9e7f6efd3093c32ecceabd57fb03cf760c926d2a7bfa265babf29ec98a
 f0d0
-BlindedElement = 03e3c379698da853d9844098fa0ac676970d5ec24167b598714
-cd2ee188604ddd2
-EvaluationElement = 030d8d882120e8fa67ef978a9abac506acd5ec731b8e8d6f
-15035e29241dd2ced2
-Output = ab653a4f3b357177b125e1c6d0bd2c0bc409b7ed5f48c99537fbd7fd11e
-f8133
+BlindedElement = 03e9097c54d2ea05f99424bdf984ea30ecc3614029bd5f1139e
+70c4e1ae3bdbd92
+EvaluationElement = 0202e4d1a338659c211900c39855f30025359928d261e6c9
+558d667b3fbbc811cd
+Output = 15b96275d06b85741f491fe0cad5cb835baa6c39066cbea73132dcf95e8
+58e1c
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -287,12 +287,12 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 825155ab61f17605af2ae2e935c78d857c9407bcd45128d57d338f1671b5
 fcbe
-BlindedElement = 030b40be181ffbb3c3ae4a4911287c43261f5e4034781def69c
-51608f372a02102
-EvaluationElement = 03991df04e3e526d457065b6eafc855aa2fc4528c22d2b51
-6a3c71227b1b488f44
-Output = eca4df985f7c49b091c3ce4217be1f26cdc6a148b681ed1f1638d09dfd2
-13e6e
+BlindedElement = 03fa1ea45dd58d6b516c1252f2791610bf5ff1828c93be8af66
+786f45fb4d14db5
+EvaluationElement = 02657822553416d91bb3d707040fd0d5a0555f5cbae7519d
+f3a297747a3ad1dd57
+Output = e97f3f451f3cfce45a530dec0a0dec934cd78c5b656771549072ee236ce
+070b9
 ~~~

 ### Verifiable Mode
@@ -300,10 +300,10 @@ Output = eca4df985f7c49b091c3ce4217be1f26cdc6a148b681ed1f1638d09dfd2
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = 4e7804245a743c59d624457677294e04a8bc4bdcd94f0d3bd54f568067489
-d34
-pkSm = 03b51a0af95c819b09ee80c2056cf0ab0551a5355266d3a0aaff90c3fe915
-ed892
+skSm = 7f62054fcd598b5e023c08ef0f04e05e26867438d5e355e846c9d8788d5c7
+a12
+pkSm = 03d6c3f69cfa683418a533fc52143a377f166e571ae50581abcb97ffd4e71
+24395
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -313,16 +313,16 @@ Input = 00
 Info = 7465737420696e666f
 Blind = cee64d86fd20ab4caa264a26c0e3d42fb773b3173ba76f9588c9b14779bd
 8d91
-BlindedElement = 0222f5dba2da1ec7bd1086d0e04894ef1da1c11163daf376b2b
-c76cc51edb16815
-EvaluationElement = 02f2767135f75f69b257675b38f2bcd50338a655a5092166
-3c8942ca61ea7d3c29
-Proof = ffa082fc9f9a287e7edc50e3ad879ee13aebd24b69124792bdf047c643f7
-0af2b50907b2fa188b90aff3b25e1d9abb02e9e2c8bfdc525c61ca008428940fca64
+BlindedElement = 029e103c4003ab9bf4a42e2003dd180922c8517927a68320058
+178fee56c6ac8a0
+EvaluationElement = 02856ac0748085d250d842b8b8fff6c1a9f688c961de52c4
+a1e6c004c48196a123
+Proof = 2a95bd827cf47873c886967ef6c17fe0e46efddd3b5f639927215cb7592a
+4bf12a29117174a1af5899d64855352690e416b37f2a95580846a6bec445d82364fc
 ProofRandomScalar = 70a5204b2b606f5a28328916e1e5ea5a17862d7a261fdd6d
 959759758d5e34ac
-Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8
-94448
+Output = 14afc50acf64589445991da5b60add8b3f71205d53a983023d3cdaf8c95
+c300d
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -332,16 +332,16 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 5c4b401063eff0bf242b4cd534a79bacfc2e715b2db1e7a3ad4ff8af1b24
 daa2
-BlindedElement = 02f84403d1ceb40a3668349f7c349f806d2c858785853324c66
-7505018d13ee160
-EvaluationElement = 0216d7d342ef50113244b444dfedaec78810959e40fef0a6
-922658d44accb1e9c1
-Proof = f496e58818c25ffb386f22ceb57a83da1200612b67aaa07608b3375c25b2
-97e03e67d1f6094a8012725dc63a0c2f4f870173b97a3daa03588f777655a087fbbf
+BlindedElement = 0323aabcfa93e9570524253671b3ce083144b183cecb562ec8f
+8a8472fc8cf341b
+EvaluationElement = 03087bc7e00b8ad80b8a27484b91f8bf824a5d896a703135
+4edfa3269866493d9f
+Proof = fe55ecc9a92f940d4a56207a58e5554c6976b9425c917d24237b0a35c312
+bdcdea778a5c56690309ff28f26cc8bc5994e85868e3c870e5a32c0a559d80deccb8
 ProofRandomScalar = 3b9217801b5d51cef66d9fdbd94a53533e7c5057e09e2200
 65ea8c257c0dd606
-Output = 90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b9
-2fe28
+Output = 533c79459ee0ffa8844ac37572f3616e10a1074dcbf945ce37b0c651cbb
+5775f
 ~~~

 #### Test Vector 3, Batch Size 2
@@ -352,30 +352,30 @@ Info = 7465737420696e666f
 Blind = f0c7822ba317fb5e86028c44b92bd3aedcf6744d388ca013ef33edd36930
 4eda,3b9631be9f8b274d9aaf671bfb6a775229bf435021b89c683259773bc686956
 b
-BlindedElement = 02a840214a74345570dcadfc927e726901b257b447234fac509
-0a1830295ca736c,039a5a8152abb0154b4d79a90486e358ea325980f0bf590524c4
-460f700454238f
-EvaluationElement = 025991aac0b0c79bb1185c0b1e64964656634dfcd755cdf5
-da9ee52be0b5d5f742,03319e3baba8fa7f60dab49ef0ba68b7a85bccb5d4968643e
-2f029b6c0826911d1
-Proof = 51b5ed453168480a2e95863cda1f4d28ad5bc91e8c9c75d788569aea1679
-794a642087db120a2b3ce839f57041801f37cd4a6c05b69b327b877810293f7b09a8
+BlindedElement = 021af4563c31cf1513bc5ae0b89c5b527c7ac70614b9d31c44c
+eb292ab49c91cc4,03f7e7ebe5610710c360df40cbd90dc52c2da500664e879f2afb
+78e71f815abee1
+EvaluationElement = 03c8678cdb95e2f0eac027932c51893a20326b774ef23531
+bcd95def84060d240d,02b68c3891314a9696b5dff5df4b4e5b325938e2c5cb90f5f
+b9ba6a1133aa4dd14
+Proof = 6efbde69d36e3f9d53a79a73ce46d5d8ef31f0df2fb3f6f2c882b21fdf0e
+d76dcd755e42f35f00daaa6e964f48125cf1d642b1cea2e5faa2fb868584a8752bf2
 ProofRandomScalar = 8306b863276ae74049615162a416d507a6532c99c1ea3f03
 d05f6e78dc1edabe
-Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8
-94448,90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b92fe
-28
+Output = 14afc50acf64589445991da5b60add8b3f71205d53a983023d3cdaf8c95
+c300d,533c79459ee0ffa8844ac37572f3616e10a1074dcbf945ce37b0c651cbb577
+5f
 ~~~

-## OPRF(P-384, SHA-512)
+## OPRF(P-384, SHA-384)

 ### Base Mode

 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = ef1b52c12cdf43dc260bf5425a30cde7d708ec34b38dcfbdc2946d7baf525
-361e797f6a98f1ebd80f64865f21cde1c6d
+skSm = b9ff42e68ef6f8eaa3b4d15d15ceb6f3f36b9dc332a3473d64840fc7b4462
+6c6e70336bdecbe01d9c512b7e7d7e6af21
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -385,13 +385,12 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 359073c015b92d15450f7fb395bf52c6ea98384c491fe4e4d423b59de7b0
 df382902c13bdc9993d3717bda68fc080b99
-BlindedElement = 02fa3115c21ffcacc09ca470729b725781f84333e217cfeec2b
-8ba6a54ce492ede7ead3714c5b177427ef853effb1b5c24
-EvaluationElement = 033a4bdea2693686e4ce467c8a5cdfc41b86ad20aaaa9bc1
-6e75b59dbd41dab0bc9af0041e551ece3b4c9fb2315d8d1fa9
-Output = a5a0ef3fb964a36097662d1258ef0f93b224ddd81a356c37d5dd05a885a
-0b6722b90c1f5181637fece7ed180ba053da23bf35cef7a87dcba75562cb7a264001
-8
+BlindedElement = 0285d803c65fda56993a296b99e8f4944e45cccb9b322bbc265
+c91a21d2c9cd146212aefbf3126ed59d84c32d6ab823b66
+EvaluationElement = 026061a4ccfe38777e725855c96570fe85303cd70567007e
+489d0aa8bfced0e47579ecbc290e5150b9e84bf25188294f7e
+Output = bc2c3c895f96d769703aec18359cbc0e84b41248559f0bd44f1e5467522
+3c77e00874bbe61c1c320d3c95aee5a8c752f
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -401,13 +400,12 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 21ece4f9b6ffd01ce82082545413bd9bb5e8f3c63b86ae88d9ce0530b01c
 b1c23382c7ec9bdd6e75898e4877d8e2bc17
-BlindedElement = 025fddc89a832089a59120df742acb34dba82b26afcae977961
-57df238b5905c494a23c56b1f485cbbff78d31df7fa1492
-EvaluationElement = 02f8b59813663e7965c219c113c560482cbea7ca4c412a0c
-f3fd855ee7d543ae926d29ace85296f195f988be284b2347f6
-Output = f2a0b355cae4ae2c717d0b48e39c0ee356db3ca446fddf85cddb74f397e
-b85046da62d0d85d55d19d39dd9b68fcc39379ec6d3b93ba33909fcc96361d225cdd
-e
+BlindedElement = 0211dd06e40b902006c33a92dc476a7c708b6b46c990656239c
+d6867ff0be5867d859517eaf7ea9bad10702b80a9dc6bdc
+EvaluationElement = 03a1d34b657f6267b29338592e3c769db5d3fc8713bf2eb7
+238efb8138d5af8c56f9437315a5c58761b35cbfc0e1d2511d
+Output = ee37530d0d7b20635fbc476317343b257750ffb3e83a2865ce2a46e5959
+1f854b8301d6ca7d063322314a33b953c8bd5
 ~~~

 ### Verifiable Mode
@@ -415,10 +413,10 @@ e
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = 67ee1c9e67566d87bfcca9e5dac4bfdb8bdd727c031133fac2aa9ba6c41e6
-1e5f8fd401b5d76c7d54b15b15932797479
-pkSm = 029b51b2ce9c499f2056e65e0f41d60960f9c4795c0cf94af273ce840c20b
-e4cdf87690b6b121b37d399b49afcc2ec9ac3
+skSm = 42c4d1c15d27be015844404088967afe48c8ae96d4f00ce48e4d38ecabfb8
+feb5b748de625cdf81ab076745d6211be95
+pkSm = 0389ad5e50eebf9617ae3a5778e4f0665b56aa9066919e1fa5580d8dd781d
+560824e0e78aae816af6eff8abe2ad0585a0d
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -428,18 +426,17 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 102f6338df84c9602bfa9e7d690b1f7a173d07e6d54a419db4a6308f8b09
 589e4283efb9cd1ee4061c6bf884e60a8774
-BlindedElement = 02a1f41323e91a6ac9fbbb5b8e4c7c58a4c5bcbaa4195557182
-cd59e826dc847f1e077de1d402ac92eafe322461fc0d582
-EvaluationElement = 03af3164f8721a57931f92884b43c58ff0ed1be249f7e1c9
-3033a5909f0ffc59ed3fea9452ec5c9cfb865b8bd2e65cd209
-Proof = 44108ca9b342f4d7e31a250aa9f41afb0de840e113dbb6bb82b5e6735aef
-18a20867a63628be6e109d2d687e1faa8888270f1173bc6f916e21142096d23d1719
-4edf844074922c287a50182f87bbb5fc3a966c8851dd6799ec5cfe59c7063c7f
+BlindedElement = 02ae8990d580dcd52b6bc273bc6d0fd25be50b057511b953d9c
+c95bb27cb3e1fd3249ae19744ed496c6e4104ebc1ed48f1
+EvaluationElement = 024cffdae0cae5fa4d6a68246ae797dbe06508284b65e0f0
+9046977ab5d52a8b38f0245607db74979e5276fc636332cdee
+Proof = 128ad4f987ce1e3a9aab1e487df15d8c8000d5c4c9f14bd7fd699fabdb8d
+a3f577d91625fabb0d9cf6069f8af6d9cc232dd63cd161be84a1e146e0110dc741e6
+26a082193aa0a26e03118b662f1b903667f6e6fba51d69a2d65982a3b64ecb35
 ProofRandomScalar = 90f67cafc0ffaa7a1e1d1ced3c477fea691e696032c8709c
 86cbcda2b184ad0029d29abeabede9788d11782429bff297
-Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51
-eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe
-0
+Output = 8a0b4829bc8422b1a2301d5471256892883c5e3fe27b998d1010225a706
+545637336a20a76f842d8a22e591d382c77e4
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -449,18 +446,17 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 8aec1d0c3d16afd032da7ba961449a56cec6fb918e932b06d5778ac7f67b
 ecfb3e3869237f74106241777f230582e84a
-BlindedElement = 02b3465d70f76de3eaf6ecb8080490288f741c622c06d023bd1
-80a55a2e3e4eaad08533651f9d278a3f59cec8277780303
-EvaluationElement = 03a53e01901893585437cd48a1eea1188fc8e9275a80cf43
-370a451c476dae3b84ca8c7bf44fcac2fa3eeab933b25da0c3
-Proof = 5ebc467e78ae29f7d741221df0ee67285df72ec482fdc8e5bde7e588b12f
-cba86f4f116c23ee6b32c0f38f2daac67e869e53e7e0494cc883e4984daf10a55819
-bbb5ce7e9005f143b3dda88d8a35649269a4658a98c81c814097d15a3dcf4dbe
+BlindedElement = 02a384f2d9635adffcc5482344c519036c019f3cc0918ec737c
+67cdda10ac0f73a9fe348835531f1900ea2c1f06dacdce4
+EvaluationElement = 0306f0f71b58d53ae0973538a7bf2ce8fba7143efc88d2ef
+ca6cf1f98fb8399b16840d1fbbe7897807db930f67916418ae
+Proof = 2c47297ee0093061ca2c87b430b2851a860aaae76c2bdba48779ba4294e7
+de0556ede3e6b881a04970b68a6126e2fa197d69e6784fbbd173604501c0edd21696
+628f0fd7cb13be28f94e5e15c042ffccadd780b2448d7d9d528e9615e4e70539
 ProofRandomScalar = bb1876a7f7165ac7ec79bfd5213ea2e374252f29a6e19915
 f81b0c7dcea93ce6580e089ede31c1b6b5b33494581b4868
-Output = 5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920
-267a40b246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92
-c
+Output = 8c52d40c1f6cc80208bd610178a5034d6c4a05584e19b69617f846b09a8
+545443c63c8aa4d85bf0aad368e0591b1216a
 ~~~

 #### Test Vector 3, Batch Size 2
@@ -471,23 +467,22 @@ Info = 7465737420696e666f
 Blind = 41fabd4722d92472d858051ce9ad1a533176a862c697b2c392aff2aeb77e
 b20c2ae6ba52fe31e13e03bf1d9f39878b23,51171628f1d28bb7402ca4aea6465e2
 67b7f977a1fb71593281099ef2625644aee0b6c5f5e6e01a2b052b3bd4caf539b
-BlindedElement = 02d715dfce1a0724071fa8e530d79f7b234a31739a64166e0fe
-21fa6fa0fe19e1ab5e468becca899f31e365c47f3efb2ef,028dfd0c7a38b4cb8477
-cae34f041344fb44fc9e55bfa3cf55ab7b4764b74accc7b49c0ff09a524598033dad
-1152fb3a1c
-EvaluationElement = 03f9a8c81c108201888eb86348c6f80691d99425272972b5
-bf41d3038af0eeb04d60edd9ea288625a7166a8c17cea0083f,02abb31980533dbf7
-eb5fee0a8969089b3e16585a2cd41a34067592a2021b1b4ea3d1cef3e7c87a6f284c
-0e45546c92d98
-Proof = f0f7bd2723c3460d5c5ab03092c6861fb34253470ef430dac9aeac6ce489
-84b28d91178061cba02e3e911c4aa97229d519755db385ddd08064fdf8405897d1de
-a472688934088505e89dcff91081fec1d2e37c1d4c5a9dddbdd358aa89f63b46
+BlindedElement = 02d4e6186c9ffa92565055f43f27bb1e2c4103c3325bba0b499
+adb99a157987d20fb374096814e438a6b483efa8f2a3307,033a3b052416a8a6d842
+a0baea6f5fab99d36645a70c89897a536970d34038eca35afac24906294cb7925b1b
+05e4327c8f
+EvaluationElement = 037bf8e28a0607b1f8aa59363380b5a7450b66b98017cf03
+3797f6c6c74e7625a445f71ace1bea7836ea5baa75d54eb5bd,03b793a9cb2d76991
+f1d6cd822abfbfa89fdfa1a06ef42b0bc8ade161e1996ed08c288a08366d4140c762
+7bba4e3472bcf
+Proof = 27240901b6855d2b58ce84afefa91dd11819d7d5df73f94865a9d7e19020
+41200eb732b60b57fa0daf6e456402bb1ccb1aed901af35d3d790cd7c618604b766b
+b9271010354da9e4e5507e0468adf177977143db2ddb94d9b70e837ad7578275
 ProofRandomScalar = 1b538ff23749be19e92df82df1acd3f606cc9faa9dc7ab25
 1997738a3a232f352c2059c25684e6ccea420f8d0c793fa0
-Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51
-eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe
-0,5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920267a40b
-246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92c
+Output = 8a0b4829bc8422b1a2301d5471256892883c5e3fe27b998d1010225a706
+545637336a20a76f842d8a22e591d382c77e4,8c52d40c1f6cc80208bd610178a503
+4d6c4a05584e19b69617f846b09a8545443c63c8aa4d85bf0aad368e0591b1216a
 ~~~

 ## OPRF(P-521, SHA-512)
@@ -498,9 +493,9 @@ eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = 016ee706f30ce7e15e4ffa3114c7d59a7b6f302d531ca60419be39d1cd43e
-e13b1fc8398b7f63a900cdc49c6e99f65a74403db2fa739927a2ee288cff857d9d84
-ecf
+skSm = 00a2f8572ee764d2ec34363fb62ef9e8ff48883b5357b6802f43fffe5c5fd
+0d11f766bf7086aab33e2dce02cc71d77250ef6ed360a3fd56244abb6bdbc3aa6534
+da1
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -511,15 +506,15 @@ Info = 7465737420696e666f
 Blind = 01b983705fcc9a39607288b935b0797ac6b3c4b2e848823ac9ae16b3a3b5
 816be03432370deb7c3c17d9fc7cb4e0ce646e04e42d638e0fa7a434ed340772a8b5
 d626
-BlindedElement = 0301f0a8c68e58f5571bd39fe3b0b2aa055a8c34e3d68ba0d2e
-d177db0bc7575d477ed8f557596feb5ac568fe738eee8cff7dcb56dc78f52bf381c0
-912e0e84b5a3f5b
-EvaluationElement = 0200d7b1131aa9f8c365de7bd7903738f61bdecfaada375a
-ba3905bdaad1301c7cd537f69abff04140ccca29a4c46cb4a036160e55a9621210b3
-71d84646b0199571fa
-Output = 61eea8fedfa9338dd22fac279f1f3f9e96693919c59ea3918c7a441115e
-6bdecb1d05b5da55d4024858c92d3911a81d4eca362123b2911e5dc58591bf7be29c
-7
+BlindedElement = 03006ce4a27e778a624d943cf4db48f9d393d3d4dd9cd44b78a
+cf2d5b668a12f0ca587962de8c82b5aaa1f0166eb60d511f060aaab895fc6c519332
+77bc945add6d74a
+EvaluationElement = 030055f7cd3ee3b1734e73ad8bbd4baca72ae8d051160c27
+7ee329f23fa2365f9f138b38e6e2c59cc287242eeca01fae83d0c7cc3bb19724ac59
+8a188816e7cfe1ca88
+Output = aa59060a41ec8ca7b6c47f9c5a31883a44ffd95869a09dbe845ea8ce20c
+b290dba0b57c505824a0dcf6f961a2baeb8e6b49df8c158761a3fdb46f39e8e7fcb8
+b
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -530,15 +525,15 @@ Info = 7465737420696e666f
 Blind = 01a03b1096b0316bc8567c89bd70267d35c8ddcb2be2cdc867089a2eb5cf
 471b1e6eb4b043b9644c8539857abe3a2022e9c9fd6a1695bbabe8add48bcd149ff3
 b841
-BlindedElement = 030099c35342a43221c6e03debfb17bad71b62e04c9242aa6e9
-f2f915163ef4f5b8b7fe1740a4d636c36bd5c73ca39c69992dc7f6dff8f232125efc
-22af4df8352fea2
-EvaluationElement = 0300ceeba6751486eecc479ab2259e3a57c13b0710f61c82
-87acad60624974b76ea242dbcae3a9daad1bdc9c49012c8d8b384d510980cc1ef8fa
-8d10502748ce63d93f
-Output = 6682273a5199b2454a706cac557008e2264580ac39b6995e1f47130b985
-d1015de7713d3bdb121212a68de2ece73bf72e41738a01c23428753c44e3dd39b5de
-3
+BlindedElement = 0201459ba64ad0e0f9f689f0ad5ab29ca5b960f5c9da3aef412
+6d2d547b871e754b17971fd45e0d64bdcfc8d256c342a141f04e2640705c38936c8c
+f53c22ea6b13966
+EvaluationElement = 030094036457e8e5bf77719b11f01dd4aa2959efdb3329c3
+e3b25493efc3ab572c2e7db104cd5922645320ef51bbb282f84e5f6b08e9b49354f9
+d6a9f3a4327a1de6e4
+Output = 5efe6f00f45ec4e87e4c9b89aeaec61313c15c0a0a21ee2e41362d6af54
+536adf2f68d23c729b92b6fa8d5611764b0272be6cc153d47a0256c8cb44bd740037
+a
 ~~~

 ### Verifiable Mode
@@ -547,12 +542,12 @@ d1015de7713d3bdb121212a68de2ece73bf72e41738a01c23428753c44e3dd39b5de
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = 0017674057e06c5e3e8a331f2dc3558540701c9cd0f4c19126d5972af6a01
-447b312d05a06dab3e9e07c891d749444c27ede0897ad42aea03b887eb5db93e3f29
-a86
-pkSm = 0201ee4e2eaa74728f577f4bb282c5440cd454fdee1d79b15a36d34b5e5a1
-25e3ccc0f99e32cc0a6a15b5652a0c8a424860c6753f685d0e1e150ceba24ca3386f
-29216
+skSm = 0064799c2f9c0f9e6b9ac2aca5c42687cf15742fb73e086c4954aa0bdc8b8
+25911ff03712e8d308c0a6ff5435375036f189391234bf21aac57fa73df155d70da4
+7bd
+pkSm = 03013e587a7750213bb7c2b338a4507635f1ba60ece346de32ad975373e56
+fbabd878f9956996aac83a550ed5f5ba98fcc56817f6230cc7e84cb7eb2a1e1db51d
+bfc1b
 ~~~

 #### Test Vector 1, Batch Size 1
@@ -563,22 +558,22 @@ Info = 7465737420696e666f
 Blind = 00bbb82117c88bbd91b8954e16c0b9ceed3ce992b198be1ebfba9ba970db
 d75beefbfc6d056b7f7ba1ef79f4facbf2d912c26ce2ecc5bb8d66419b379952e96b
 d6f5
-BlindedElement = 0200357f949a0a0bdfeb682734dbdeb778f3845045617b21436
-27753332e2e75458ab183b12635c75e19afaf56981e7755803026842db1b22fa42c8
-61413d07ff86545
-EvaluationElement = 0201d636bac3f77c1091b337daae32259a3eacd57e3c0fb1
-444fe5ce22af6acdcef4a46a2b5e169aa8d0e26ec2a3621c15dd366ba1978dae761c
-1ef3dac63c60cbee88
-Proof = 011ebe27ebc79e5679b643c6b3a51333499c7abee86c092181c0a8e7e539
-e0ba30b1c128666708c753696ace2aa789c4975b0b80d6241a1dafe85c39a7338d1e
-20d00131c8a81b5f64209f8fe53e8c6a00789a893f20596198e2521275e05d925298
-08e9f54030fc8be2ce78c6df0d29e6fd7d8e623e0ccc7b19b194493dacd2a4eb3a32
+BlindedElement = 02002ff3ef3f2411aa0358936f852be710af790c9affbced8c3
+9b018fd97de0a45d80c66cbf0dbda690ee4f594e0795627e6c6f37a500f223c30f31
+c24e73501532e7c
+EvaluationElement = 0300769fd56c5174c4e3922900fcefdd5a89c9592f4d8e8f
+2396678fa72c01d4f8551ec92d4b5287ca673dc29d8db9bb05d2396121a6b8732b68
+ebf310fc2620059d67
+Proof = 011fd92f54f6a955a333648d843807bd88f644d235a7d592189da42d721e
+a6f7b55ec813146f35982487910aa15bbf5ce90653edb6a1b48c0bfd15758e9358aa
+731601baa67a3a59db301f41caa020986ae9e93a80d6c06d92e8c5eef6056fa6f342
+6b6054d118dc9fecb77fdcb4fc86b9857ada6de18394ff7d6c574cbd08d746b9dde0
 ProofRandomScalar = 00ce4f0d824939827888f4c28773466f3c0a05741260040b
 c9f302a4fea13f1d8f2f6b92a02a32d5eb06f81de7960470f06169bee12cf47965b7
 2a59946ca3879670
-Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8
-79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29
-5
+Output = a647c5a940aa19d767ab0e163d1357ca068206b2b78f9e8e1021c0bb0f3
+27d20cb8fadf996199d86d4cc0a08ac314493319979e1c2a98a96085b8fabff9f0d0
+7
 ~~~

 #### Test Vector 2, Batch Size 1
@@ -589,22 +584,22 @@ Info = 7465737420696e666f
 Blind = 009055c99bf9591cb0eab2a72d044c05ca2cc2ef9b609a38546f74b6d688
 f70cf205f782fa11a0d61b2f5a8a2a1143368327f3077c68a1545e9aafbba6a90dc0
 d40a
-BlindedElement = 030185e431f056e75ba7fac49da70790031daa333d16f05e1de
-471e24afe0ed985c770ce77bd1bebec527e9a76feecc6afd92c5fd00481ba7fb843d
-2aab52337cb716e
-EvaluationElement = 02000859e1abc2ed28086b854ec5ae72311244fdeedf81d7
-69af6a6f2c83f00fa48df1f1a0c0b6fac84cc654b7757ac042107a6b3043e483bb3b
-74de5d6c301b20e8f6
-Proof = 01629dd5af14c7414801d879b1018ce06bcc5c5d0a64ca422b76aaa531c8
-ecca630919fb4b51fa60fdc215f73e67e8d617d55ca6a227343d434d5e0f487567f8
-5bfa016959443267bb7d9a5c5e5b1c4d20026394b4edaca7dfbc1aa3b3c2020cf995
-79cf276c0e84f0cb5a820226fa3b81d42de2db39d8412642e70428e485a61ee9d760
+BlindedElement = 0301e2ecf7313820e9d47763e12633ce6acf9b3dec89928c83b
+de1ede2180dc73553af1317408846af5c53ebfed00d19a4125f4ffb7df9f4260ccc0
+84a6f7482414a9d
+EvaluationElement = 02000e69591ab605652cb3310e774edf79417e102cf89005
+c2c7f2bd3a06060d740817802f2cf484748d93df5b281a4bd835617a97ec9809519d
+474ca53bba15cdf014
+Proof = 0076fa4275414acb9f87dc9e4f20971d51fcd0d38a980854ac2ad1bd5737
+eec23bfb4599d021881f7b3872d2e90d9b47e4219f490cf7f0235b2f0859cb2ef15d
+dfd401acb6b0844edf066a5767b4b85536bfee69bdf472acf7a59254cf6578f9f35e
+ba51bb58c6428d6b7c9e5c9af97edc66d98886fda9544048bf9ceea6fc745bf970da
 ProofRandomScalar = 00b5dfc19eb96faba6382ec845097904db87240b9dd47b1e
 487ec625f11a7ba2cc3de74c5078a81806f74dd65065273c5bd886c7f87ff8c5f39f
 90320718eff747e3
-Output = 7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d
-1b2e936669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c13011057
-1
+Output = 8d109503ccced41cbec087dab86c607763020be93bdd5ec8508cb078607
+1a2b22a7b06150242bcaf6ea1b555a994e0266647eb72914caf73cabe53ddfb0f940
+d
 ~~~

 #### Test Vector 3, Batch Size 2
@@ -617,26 +612,26 @@ ae9b4703e17e559ca3ccd1944f9a70536c175f11a827452672b60d4e9f89eba28104
 6e29,00cba1ba1a337759061965a423d9d3d6e1e1006dc8984ad28a4c93ecfc36fc2
 171046b3c4284855cfa2434ed98db9e68a597db2c14728fade716a6a82d600444b26
 e
-BlindedElement = 0301978860af75cd69acbc93e8c9fc530e5d2b2208da42c65bf
-e079f0f6e0b3fc6080556c10739271d2a8fe578409d4fa9b19ef0484d9c15451c4e7
-0501e31da7608cb,0200e30565c3d7e02c822762f25db4c872811adb2cbfbad92b04
-291bc8c476d0546d1c5ecf5c58ff06b8d19aad8eca9e5f1a80ff8e981ebc490b0cfb
-d5d499b47bad8e
-EvaluationElement = 0300abdee910f144c3be460e724c11626e1f9986f72e2c43
-3a9c4dad2ef6fcb9249c9a5036334ba88b0892462b6f8ad419c38cc259b0c774a9bd
-0c4d545d0914413ea2,02019696f91dcc178bbe6b97f822cdc4052f9b94852ff6023
-f6068848f867df40e54a5f1525e7fafa383e82fe36bf3c74427b51903032d0f89876
-05bf24ee003f37693
-Proof = 008fa896b69c1efc4e9c6bdfd0b149444532d5ba3bfd957cf7cd71c374d3
-a1cca25f17b60616164377b0734243bc878e17d3ecab36b3e3565b5c6218dae92d40
-c0be018707381f6f4b0153044737030b5d9851c15609532da8932c1fa1f4901dba05
-a4118d25142344f9ea1465c907eb13d908a45d8b98265eac48819a04cae859b0643a
+BlindedElement = 0201e22c01df5ac0502842fad603f7a1e1183bcc79a5cb04bb7
+befdea870a9a6ea96fbccd752ea9927a9e1e28438098f693461e81832a3f690616bf
+983fced079f3a33,0300b49216dd8ba5ba1275d8345679f70fbc6baf4f4b32a03e91
+7165a18afa9fad849c48eecb4bae965057ef7c215b52b42ca53c8d5f650633e0bb70
+97f2bd809d09ea
+EvaluationElement = 03002949c2478249b918a0cf2cd870226541a81d2f3e88c4
+7119f732301e749c3dea317c11174a18b89d1b9d2aa4f6ae92ae724e03a4800a26b7
+c827b00199f1114bcd,0300924ab017ea6e6328a0b0f341bbeb7d209c67ac169fa4e
+f7b04055c66b92aa9657f5d83b0b1ee9c79f3f0198519c97fef07dbecf3f6d477755
+0242a1c87953f9461
+Proof = 01f5d3c3f835d91aa88202f0fe8728180eeffe7fbc66ffe3f7a7dd958696
+a7cd3d47b3c0ec6cd59e9ee23090137293e6f42269923f3d4a1659bc706fd9762070
+7d230028cd4b0aa237b91a352fce81248936826ba99e7bd5103a871715126014b8d4
+7447e5f20192ed377a7431516fbd82763098ba23f9d15b84fe24fb1126beb0d46f03
 ProofRandomScalar = 00d47b0d4ca4c64825ba085de242042b84d9ebe3b2e9de07
 678ff96713dfe16f40f2c662a56ed2db95e1e7bf2dea02bd1fa76e953a630772f68b
 53baade9962d1646
-Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8
-79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29
-5,7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d1b2e936
-669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c130110571
+Output = a647c5a940aa19d767ab0e163d1357ca068206b2b78f9e8e1021c0bb0f3
+27d20cb8fadf996199d86d4cc0a08ac314493319979e1c2a98a96085b8fabff9f0d0
+7,8d109503ccced41cbec087dab86c607763020be93bdd5ec8508cb0786071a2b22a
+7b06150242bcaf6ea1b555a994e0266647eb72914caf73cabe53ddfb0f940d
 ~~~
 "#;
@@ -0,0 +1,180 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under both the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree and the Apache
+// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
+// of this source tree.
+
+//! Helper functions
+
+use crate::errors::InternalError;
+use core::array::IntoIter;
+use generic_array::{typenum::U0, ArrayLength, GenericArray};
+
+// Corresponds to the I2OSP() function from RFC8017
+pub(crate) fn i2osp<L: ArrayLength<u8>>(
+    input: usize,
+) -> Result<GenericArray<u8, L>, InternalError> {
+    const SIZEOF_USIZE: usize = core::mem::size_of::<usize>();
+
+    // Check if input >= 256^length
+    if (SIZEOF_USIZE as u32 - input.leading_zeros() / 8) > L::U32 {
+        return Err(InternalError::SerializationError);
+    }
+
+    if L::USIZE <= SIZEOF_USIZE {
+        return Ok(GenericArray::clone_from_slice(
+            &input.to_be_bytes()[SIZEOF_USIZE - L::USIZE..],
+        ));
+    }
+
+    let mut output = GenericArray::default();
+    output[L::USIZE - SIZEOF_USIZE..L::USIZE].copy_from_slice(&input.to_be_bytes());
+    Ok(output)
+}
+
+/// Simplifies handling of [`serialize()`] output and implements [`Iterator`].
+pub(crate) struct Serialized<'a, L1: ArrayLength<u8>, L2: ArrayLength<u8>> {
+    octet: GenericArray<u8, L1>,
+    input: Input<'a, L2>,
+}
+
+enum Input<'a, L: ArrayLength<u8>> {
+    Owned(GenericArray<u8, L>),
+    Borrowed(&'a [u8]),
+}
+
+impl<'a, L1: ArrayLength<u8>, L2: ArrayLength<u8>> IntoIterator for &'a Serialized<'a, L1, L2> {
+    type Item = &'a [u8];
+
+    type IntoIter = IntoIter<&'a [u8], 2>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        IntoIter::new([
+            &self.octet,
+            match self.input {
+                Input::Owned(ref bytes) => bytes,
+                Input::Borrowed(bytes) => bytes,
+            },
+        ])
+    }
+}
+
+// Computes I2OSP(len(input), max_bytes) || input
+pub(crate) fn serialize<L: ArrayLength<u8>>(
+    input: &[u8],
+) -> Result<Serialized<L, U0>, InternalError> {
+    Ok(Serialized {
+        octet: i2osp::<L>(input.len())?,
+        input: Input::Borrowed(input),
+    })
+}
+
+// Variation of `serialize` that takes an owned `input`
+pub(crate) fn serialize_owned<L1: ArrayLength<u8>, L2: ArrayLength<u8>>(
+    input: GenericArray<u8, L2>,
+) -> Result<Serialized<'static, L1, L2>, InternalError> {
+    Ok(Serialized {
+        octet: i2osp::<L1>(input.len())?,
+        input: Input::Owned(input),
+    })
+}
+
+macro_rules! chain_name {
+    ($var:ident, $mod:ident) => {
+        $mod
+    };
+    ($var:ident) => {
+        $var
+    };
+}
+
+macro_rules! chain_skip {
+    ($var:ident, $feed:expr) => {
+        $feed
+    };
+    ($var:ident) => {
+        &$var
+    };
+}
+
+/// The purpose of this macro is to simplify [`concat`](alloc::slice::Concat::concat)ing
+/// slices into an [`Iterator`] to avoid allocation
+macro_rules! chain {
+    (
+        $var:ident,
+        $item1:expr $(=> |$mod1:ident| $feed1:expr)?,
+        $($item2:expr $(=> |$mod2:ident| $feed2:expr)?),+$(,)?
+    ) => {
+        let chain_name!(__temp$(, $mod1)?) = $item1;
+        let $var = (chain_skip!(__temp$(, $feed1)?)).into_iter();
+        $(
+            let chain_name!(__temp$(, $mod2)?) = $item2;
+            let $var = $var.chain(chain_skip!(__temp$(, $feed2)?));
+        )+
+    };
+}
+
+#[cfg(test)]
+mod unit_tests {
+    use super::*;
+    use crate::voprf::{
+        BlindedElement, EvaluationElement, NonVerifiableClient, NonVerifiableServer, Proof,
+        VerifiableClient, VerifiableServer,
+    };
+    use curve25519_dalek::ristretto::RistrettoPoint;
+    use generic_array::typenum::{U1, U2};
+    use proptest::{collection::vec, prelude::*};
+    use sha2::Sha512;
+
+    // Test the error condition for I2OSP
+    #[test]
+    fn test_i2osp_err_check() {
+        assert!(i2osp::<U1>(0).is_ok());
+
+        assert!(i2osp::<U1>(255).is_ok());
+        assert!(i2osp::<U1>(256).is_err());
+        assert!(i2osp::<U1>(257).is_err());
+
+        assert!(i2osp::<U2>(256 * 256 - 1).is_ok());
+        assert!(i2osp::<U2>(256 * 256).is_err());
+        assert!(i2osp::<U2>(256 * 256 + 1).is_err());
+    }
+
+    proptest! {
+        #[test]
+        fn test_nocrash_nonverifiable_client(bytes in vec(any::<u8>(), 0..200)) {
+            NonVerifiableClient::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+
+        #[test]
+        fn test_nocrash_verifiable_client(bytes in vec(any::<u8>(), 0..200)) {
+            VerifiableClient::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+
+        #[test]
+        fn test_nocrash_nonverifiable_server(bytes in vec(any::<u8>(), 0..200)) {
+            NonVerifiableServer::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+
+        #[test]
+        fn test_nocrash_verifiable_server(bytes in vec(any::<u8>(), 0..200)) {
+            VerifiableServer::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+
+        #[test]
+        fn test_nocrash_blinded_element(bytes in vec(any::<u8>(), 0..200)) {
+            BlindedElement::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+
+        #[test]
+        fn test_nocrash_evaluation_element(bytes in vec(any::<u8>(), 0..200)) {
+            EvaluationElement::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+
+        #[test]
+        fn test_nocrash_proof(bytes in vec(any::<u8>(), 0..200)) {
+            Proof::<RistrettoPoint, Sha512>::deserialize(&bytes[..]).map_or(true, |_| true);
+        }
+    }
+}
Author	SHA1	Message	Date
Kevin LewiandGitHub	d9dc5d0a13	Updating test vectors to sync with draft version 08 (#32 )	2021-10-25 22:06:42 -07:00
Kevin LewiandGitHub	1b3837a789	Publishing v0.2 (#31 )	2021-10-18 16:47:13 -07:00
Kevin LewiandGitHub	093a15f597	Adding deterministic_blind_unchecked functionality under danger feature (#30 )	2021-10-18 13:24:15 -07:00
daxpeddaandGitHub	14830f1436	Remove allocations by `serialize` (#29 ) * Changed `expand_message_xmd` input to `Iterator` * Changed `hash_to_scalar` input to `Iterator` * Fix rustfmt * Add documentation for private helper types * Fix documentation * Improve `chain!()` syntax bias * Move helper functions to `mod util`	2021-10-15 16:56:21 -07:00
Kevin LewiandGitHub	8457e8b900	Adding "danger" feature to expose underlying elements (#27 ) * Adding internal feature to expose underlying elements * Applying @daxpedda's comments and suggestions	2021-10-14 13:55:43 -07:00
daxpeddaandGitHub	de91fafdb3	Group improvements (#28 ) * Implement `ConstantTimeEq` for `Group` and `Group::Scalar` * Changed `expand_message_xmd` `dst` parameter to `GenericArray<u8, D>` * Remove allocation for `dst_prime` in `expand_message_xmd` * Remove allocation for `msg_prime` and `b` in `expand_message_xmd` * Remove unnecessary references in `expand_message_xmd` * Return `GenericArray` from `expand_message_xmd` * Oxidize loop in `expand_message_xmd` * Remove allocation for `b` in `expand_message_xmd` * Remove allocation for `xor` * De-duplicate code in `expand_message_xmd` * Remove unnecessary features * Make ristretto optional and export all backends * Make `rand` optional * Fix wrong documentation * Document `rand` feature * Remove empty line * Fix rustfmt * Fix testing with other backends * Iterate by value in `expand_message_xmd` * Fix typo * Rename `ristretto_x` features to `ristretto255_x` * Remove `rand` re-export * Improve `expand_message_xmd` loop * Remove unnecessary `#[doc(cfg())]` * Remove unnecessary `pub(crate)` for `mod p256` * Fix `p256` only build * Rename `serialize` feature to `serde` * Fix missing `Cargo.toml` update	2021-10-14 11:09:00 -07:00
daxpeddaandGitHub	5ac52388ff	Reduce allocations and some general code improvements (#26 ) * Remove unnecessary paths * Remove unnecessary conversion for `G::from_scalar_slice` * Remove unnecessary allocations * Return `GenericArray` from `get_context_string` * Use `zip()` instead instead of indexing * Changed `compute_composites` input to `Iterator`s * Changed `generate_proof` input to `Iterator`s * Changed `verify_proof` input to `Iterator`s * Reduce allocations in `verifiable_unblind` * Changed `verifiable_unblind` input to `Iterator`s * Changed `batch_finalize` input to `Iterator`s Removed `BatchFinalizeInput` * Reduce allocations in `VerifiableClient::finalize` * Changed `finalize_after_unblind` input to `Iterator`s * Changed `batch_evaluate` input to `Iterator`s * Reduce allocations in `evaluate` * Changed `blind` input to `Into<Vec<u8>>` * Remove note about `BatchFinalizeInput` from documentation * Remove `Metadata` * Changed `blind` input to `Vec<u8>` * General improvements to test code * Fix rustdoc * Remove unnecessarily installed components	2021-10-12 15:07:47 -07:00
daxpedda GitHub Kevin Lewi	fab7528a69	Improvements (#24 ) * Remove manual `Debug` impl for `InternalError` * Remove unnecessary `#[macro_use]` * Remove unnecessary `tuple` handling in macro * Improve serialization macro impl * Improve `impl_traits_for` macro * Re-direct `Drop` implementation * Improve macro readability * Fix rustdoc warnings * Rust 1.51 has no support for `rustdoc` lints * Change `i2osp` output to `GenericArray` from `Vec` * Reduce calls to `to_vec()` and simplify conversion * Adding zeroize tests Co-authored-by: Kevin Lewi <[email protected]>	2021-10-10 17:51:12 -07:00
daxpeddaandGitHub	c93600498e	Add `clippy::cargo` and remove dependencies (#23 )	2021-10-05 17:52:08 -07:00
daxpeddaandGitHub	6fb4cad59c	Remove `CipherSuite` (#20 ) * Remove `Hash` * Remove `CipherSuite` * Remove single field `struct`s	2021-10-05 15:53:18 -07:00
daxpeddaandGitHub	2d8780476a	Use Clippy on test code too (#22 )	2021-10-05 15:19:20 -07:00
daxpeddaandGitHub	a3db6cd9d2	P256 improvements (#21 ) * P256 improvements * Fix Rust 1.51 compilation	2021-10-04 13:50:29 -07:00
daxpeddaandGitHub	a1ab892bdb	P256 improvements (#18 )	2021-09-30 14:00:58 -07:00
daxpeddaandGitHub	ad04f224af	Improve documentation on docs.rs (#17 )	2021-09-30 14:00:32 -07:00
daxpeddaandGitHub	7be67b26de	Re-export `simd_backend` (#19 )	2021-09-30 12:34:29 -07:00