Updating test vectors to sync with draft version 08 (#32)

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.0 (October 25, 2021)
+
+* Updated to be in sync with draft-irtf-cfrg-voprf-08
+
 ## 0.2.0 (October 18, 2021)
 
 * Removed the CipherSuite interface

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "voprf"
-version = "0.2.0"
+version = "0.3.0"
 description = "An implementation of a verifiable oblivious pseudorandom function (VOPRF)"
 authors = ["Kevin Lewi <[email protected]>"]
 repository = "https://github.com/novifinancial/voprf/"

README.md

@@ -16,7 +16,7 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-voprf = "0.2"
+voprf = "0.3"
 ```
 
 ### Minimum Supported Rust Version

src/group/p256.rs

@@ -95,8 +95,7 @@ impl Group for ProjectivePoint {
         Ok(p0 + p1)
     }
 
-    // Implements the `HashToScalar()` function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.3
+    // Implements the `HashToScalar()` function
     fn hash_to_scalar<
         'a,
         H: BlockInput + Digest,

src/lib.rs

@@ -8,7 +8,7 @@
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!
 //! Note: This implementation is in sync with
-//! [draft-irtf-cfrg-voprf-07](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html),
+//! [draft-irtf-cfrg-voprf-08](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html),
 //! but this specification is subject to change, until the final version
 //! published by the IETF.
 //!

src/tests/voprf_vectors.rs

@@ -16,8 +16,8 @@ pub(crate) static VECTORS: &str = r#"
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1
-701
+skSm = 74db8e13d2c5148a1181d57cc06debd730da4df1978b72ac18bc48992a0d2
+c0f
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -27,13 +27,13 @@ Input = 00
 Info = 7465737420696e666f
 Blind = c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf
 8e03
-BlindedElement = fc20e03aff3a9de9b37e8d35886ade11ec7d85c2a1fb5bb0b16
-86c64e07ac467
-EvaluationElement = 922e4c04b9f3b3e795d322a306c0ab9d96b667df9b949c05
-2c8c75435a9dbf2f
-Output = 9e857d0e8523b8eb9e995d455ae6ae19f75d85ac8b5df62c50616fb5aa0
-ced3da5646698089c36dead28f9ad8e489fc0ee1c8e168725c38ed50f3783a5c520c
-e
+BlindedElement = 744441a5d3ee12571a84d34812443eba2b6521a47265ad655f0
+1e759b3dd7d35
+EvaluationElement = 4254c503ee2013262473eec926b109b018d699b8dd954ee8
+78bc17b159696353
+Output = 9aef8983b729baacb7ecf1be98d1276ca29e7d62dbf39bc595be018b66b
+199119f18579a9ae96a39d7d506c9e00f75b433a870d76ba755a3e7196911fff89ff
+3
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -43,13 +43,13 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037
 e50b
-BlindedElement = 483d4f39de5ff77fa0f9a0ad2334dd5bf87f2cda868539d21de
-67ce49e7d1536
-EvaluationElement = 6eef6ee53c6fb17c77ae47e78bdca2e1094f98785e7b9a14
-f09be20797dad656
-Output = b090b2ff80028771c14fecf2f37c1b14e46deec59c83d3b943c51d315bd
-3bf7d32c399ed0c4ce6003339ab9ed4ad168bfb595e43530c9d73ff02ab0f1263d93
-b
+BlindedElement = f4eeea4e1bcb2ec818ee2d5c1fcec56c24064a9ff4bea5b3dd6
+877800fc28e4d
+EvaluationElement = 185dae43b6209dacbc41a62fd4889700d11eeeff4e83ffbc
+72d54daee7e25659
+Output = f556e2d83e576b4edc890472572d08f0d90d2ecc52a73b35b2a8416a72f
+f676549e3a83054fdf4fd16fe03e03bee7bb32cbd83c7ca212ea0d03b8996c2c268b
+2
 ~~~
 
 ### Verifiable Mode
@@ -57,10 +57,10 @@ b
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = ac37d5850510299406ea8eb8fa226a7bfc2467a4b070d6c7bf667948b9600
-b00
-pkSm = 0c0254e22063cae3e1bae02fb6fa20882664a117c0278eda6bda3372c0dd9
-860
+skSm = ad08ad9c7107691d792d346d743e8a79b8f6ae0673d58cbf7389d7003598c
+903
+pkSm = 7a5627aec2f2209a2fc62f39f57a8f5ffc4bbfd679d0273e6081b2b621ee3
+b52
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -70,17 +70,17 @@ Input = 00
 Info = 7465737420696e666f
 Blind = ed8366feb6b1d05d1f46acb727061e43aadfafe9c10e5a64e7518d63e326
 3503
-BlindedElement = 3a0a53f2c57e5ee0d89e394087f8e5f95b24159db01c31933a0
-7f0e6414c954d
-EvaluationElement = f8a50ed35a477b0cde91d926e1bc5ae59b97d5bd0dda51a7
-28b0f036ec557d79
-Proof = 7a5375eb1dbad259431f5c294e816a1c1483c279748da1a75d91f8a81438
-ea08355d4087d4d848b46878dcc8fb5849ac7a09133382c2c6129564a7f7b4b7bf01
+BlindedElement = 56c6926e940df23d5dfe6a48949c5a9e5b503df3bff36454ba4
+821afa1528718
+EvaluationElement = 523774950001072a4fb1f1f3300f7feb1eeddb5b8304baa9
+c3d463c11e7f0509
+Proof = c973c8cfbcdbb12a09e7640e44e45d85d420ed0539a18dc6c67c189b4f28
+c70dd32f9b13717ee073e1e73333a7cb17545dd42ed8a2008c5dae11a3bd7e70260d
 ProofRandomScalar = 019cbd1d7420292528f8cdd62f339fdabb602f04a95dac9d
 bcec831b8c681a09
-Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d
-eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1
-a
+Output = 2d9ed987fdfa623a5b4d5e445b127e86212b7c8f2567c175b424c59602f
+bba7c36975df5e4ecdf060430c8b1b581fc97e953535fd82089e15afbafcf310b339
+9
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -90,16 +90,16 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = e6d0f1d89ad552e383d6c6f4e8598cc3037d6e274d22da3089e7afbd4171
 ea02
-BlindedElement = a86dd4544d0f3ea973926054230767dff16016215f2d73f26d3
-f86a81f38cf1a
-EvaluationElement = 9e47810f1de1b57ebe163a95c170ec165a2063f872155c37
-6d94e8de2157af70
-Proof = 61075125d851d5164b0aa1a4d5ddeebaf097266450ac6019579af5f7abd1
-90088eb0f6f1e7f9d8bfddbc21ae3c25a065e6c4e797d15f345ed4fb9ee468d24c0a
+BlindedElement = 5cd133d03df2e1ff919ed85501319c2039853dd7dc59da73605
+fd5791b835d23
+EvaluationElement = c0ba1012cbfb0338dadb435ef1d910eb179dc18c0d0a341f
+0249a3a9ff03b06e
+Proof = 156761aee4eb6a5e1e32bc0adb56ea46d65883777e152d4c607a3a3b8abf
+3b036ecebae005d3f26222a8da0a3924cceed8a1a7c707ef4ba077456c3e80f8c40f
 ProofRandomScalar = 74ae06fd50d5f26c2519bd7b184f45dd3ef2cb50197d42df
 9d013f7d6c312a0b
-Output = fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f2
-18047d1fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0
+Output = f5da1276b5ca3de4591534cf2d96f7bb49059bd374f40259f42dca89d72
+3cac69ed3ae567128aaa2dfdf777f333615524aec24bc77b0a38e200e6a07b6c638e
 b
 ~~~
 
@@ -111,20 +111,20 @@ Info = 7465737420696e666f
 Blind = 80513e77795feeec6d2c450589b0e1b178febd5c193a9fcba0d27f0a06e0
 d50f,533c2e6d91c934f919ac218973be55ba0d7b234160a0d4cf3bddafbda99e2e0
 c
-BlindedElement = c24645d6378a4a86ec4682a8d86f368b1e7db870fd709a45102
-492bcdc17e904,0e5ec78f839a8b6e86999bc180602690a4daae57bf5d7f827f3d40
-2f56cc6c51
-EvaluationElement = 3afe48eab00493eb1b073e95f57a456cde9aefe463dd1e6d
-0144bf6e99ce411c,daaf9421318fd2c7fcdf369cb348748cf4dd177cce30ee4d13c
-eb1644b85b653
-Proof = 601381ecbe127ada04c057b8b1fc21d912f71e49252780dd0d0ac768b233
-ce035f9b489a994c1d14b92d603ebcffee4f5cfadc953f69bb62648c6e662613ae00
+BlindedElement = 1c7ee9c1b4145dabeba9ad159531432a20718cb44a86f79dc73
+f6f8671c9bf5e,7c1ef37881602cb6d3cf995e6ee310ed51e39b80ce0a825a316bc6
+21d0580a14
+EvaluationElement = a8a66348d351408cb7e2d26341a1258ba91c1a7d1b380f62
+15bdfc242500991b,5a4b72bee9d2ca80ea220571690e2f92fadd0c13635b2888bc1
+ff255f8fee975
+Proof = caad28bac17ce71d59b43956e8d80f3edde3d0c317144bef3d10d9733ef1
+cf09fd910c663ea85ad7cfaf641d73314694fe18d3f6b89cfe001b18163ff908d10a
 ProofRandomScalar = 3af5aec325791592eee4a8860522f8444c8e71ac33af5186
 a9706137886dce08
-Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d
-eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1
-a,fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f218047d1
-fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0b
+Output = 2d9ed987fdfa623a5b4d5e445b127e86212b7c8f2567c175b424c59602f
+bba7c36975df5e4ecdf060430c8b1b581fc97e953535fd82089e15afbafcf310b339
+9,f5da1276b5ca3de4591534cf2d96f7bb49059bd374f40259f42dca89d723cac69e
+d3ae567128aaa2dfdf777f333615524aec24bc77b0a38e200e6a07b6c638eb
 ~~~
 
 ## OPRF(decaf448, SHAKE-256)
@@ -134,8 +134,8 @@ fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0b
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = 78f2622804104209f7e015370ff98f4a3cbf311e6784e9f4944f8a252dc08
-e916d9ab1a60dc905f0e56631903ecd4ae6e15291776d61460b
+skSm = 82c2a6492e1792e6ccdf1d7cff410c717681bd53ad47da7646b14ebd05885
+53e4c034e02b3ae5e724600a17a638ad528c04f793df56c2618
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -145,13 +145,13 @@ Input = 00
 Info = 7465737420696e666f
 Blind = d1080372f0fcf8c5eace50914e7127f576725f215cc7c111673c635ce668
 bbbb9b50601ad89b358ab8c23ed0b6c9d040365ec9d060868714
-BlindedElement = 984e0a443ee194090737df4afb402253f216b77650c91d252b6
-638e1179723d51a4154b88eae396f1320f5df3c4b17f779516c456e364bd1
-EvaluationElement = de477252a5ff3c7d51ce159cb8ccf1865d8c7d3402824163
-8d80971f13a59d87b2b1036341b98089555ab088278391794c49bbb052fdbcff
-Output = df8f910c3b84d1f3ca6afd1992768608a20f2ad7b770e9d89d303c88ba1
-5bb7d991f2f7ffd5b5b51fa3bcf8fa06779609497f6c0ae4e9cb2dcd48c68b4ac6b9
-4
+BlindedElement = 1c354d6d31500c7c5ae6fb10901ac87552ea3af1824e79871e2
+596ef537f86abac64859cf6f35911ab74f0b09a06ecc757a65a104e9e49fb
+EvaluationElement = 9e5bbf27b2312a493b2f2f1d051b7cdf3801769ec5dc0724
+51b68c4d0d4ed9303979ec4798261a01fabd8d25540f48a11dd8342fded95383
+Output = 5f8c28d5e760786cbd000ac58444bd216141472b9370b058408a714da5e
+3dd51fc572f96c99a9338bc8569abc991bc1523fa1467cd3a0de3aef7f154bd65d92
+e
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -161,13 +161,13 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = aed1ffa44fd8f0ed16373606a3cf7df589cca86d8ea1abbf5768771dbef3
 d401c74ae55ba1e28b9565e1e4018eb261a14134a4ce60c1c718
-BlindedElement = 4aa751f84b2634b73efa364b03e60b92b84f457576e6b369eea
-b76140e3859d10d2e98174f13f5a2c70670529ccf093d5f1aaf355b4f830b
-EvaluationElement = 085ea1cb452a2fb15b3a0d0e1c86899c7ea49fe2e4856ef4
-f95bc2542eec610fc09b0fe7d7ed7389d86af6a646695b7ad46527dc2a936aa4
-Output = b57516a737879ece1110ad5d051ac0a6c54e1dcd989c907721ecebab5b4
-5877cc693c3c05d0bd416c5a9ceba36de41a0a31679c146fe4c110c64b056eba1720
-b
+BlindedElement = e8111f22d50595f68f01a6a9135f50e8702c90794c2637fbe00
+9046f0c455884cc77ee7a87f3abf494afe780b3620ab0e7fb65c65ba902b2
+EvaluationElement = 0ec625f99914ba702f0e6bc5d0f837cb4deaf7ab3ac55458
+7182c3dfe1dad6d1540964f9581d26e8ef0a47b61c5f145109a5fffe04ad528e
+Output = 7f0e40c08d8220f88c0961925f764ee0e4e08909d497f462a97a2030b40
+b44986fa76d344efb9b0acab23db81356fc8c380b80701a61a5fa76097a5d2ea7aa9
+e
 ~~~
 
 ### Verifiable Mode
@@ -175,10 +175,10 @@ b
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = 9eb722f7fee9f61f24ad31bc42309f73648cf4393929e8f5f333fe10c6975
-c827a1eba4e03ae2fa8735db2f63f6c98c7af6010e64c81f535
-pkSm = b6e2751176d57836fe1dfbdbbdc78a1b5c5a52f831226c9d8dfdf5daf8f46
-6e310e80978e9b81c387f5bc85cc7ef5567f4dd3ba7674579a2
+skSm = 5d295b55d1d6e46411bbb4151d154dc61711012ff2390255b3345988f8e3c
+458089d52e9b1d837049898f9e4e63a4534f0ed3b3a47c7051c
+pkSm = 8e623ef9b65ef2ce148ce56249ee5e69ed6acd3e504a07905cc4c09312551
+8d30ae7d6de274438b822d5a55a4365216ac588a4c400fbf6ff
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -188,19 +188,19 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 4c936db1779a621b6c71475ac3111fd5703a59b713929f36dfd1e892a7fe
 814479c93d8b4b6e11d1f6fe5351e51457b665fa7b76074e531f
-BlindedElement = d0b8e2eecad2816d45c1f8a072fe6db77d18f4b26f0889c98e2
-ef856ac5df82090c1fbeac9c8e732f192b66c3b4c3f1e446ab8910c86be2f
-EvaluationElement = d29849d8ad1e651328e8119003debd9ecd54cc786a5eb8ae
-ea56487ffc09120e98792f9475605488d16623b8e3cfa5af1ec27e76bc841b75
-Proof = 8b3b8f0c9eb22527e419f5a03d4d3f34cf725837424a38c5b4f88c7759f7
-a54bade57b7930bfeff051be9bfeaabc8976ed407398e0ce462a062e068a8d57bc1c
-411bc42fe714626cfb92ad854a56636c2b83f2b5215c2ff531b22e4d37031523db20
-3556959e275b46b84303ed23fc37
+BlindedElement = 74bb2406b15a86ba94b0686901545f8ddc23e64918de47c76fa
+0bf812387021392c73e01068ac9cc07c7647b3d0d4e648c27bb3880ddb8e5
+EvaluationElement = 90997b495c19f16561a3286a7bcba9a4ee6e12bab4d580d5
+004ae5064d90a389124e81066f3f1dbf9a729ab46ed674c3292f56d54a0d5641
+Proof = 668f6ef88b249d51b6c94bfe82f2bec35ab7386bc9f3d14209d0247a5b6e
+bedec4c333947fff96d322f516f4674cc07638b8e854c52be7045d83d65aff518104
+60ec43417a6c6efbfb67ba7b0257b1237c64e6792195e338474d09df32b076c0b702
+ec8c639b34c29878b87aad70d63c
 ProofRandomScalar = 1b3f5a55b2f18f8c53d4ecf2e1c27e1028f1c345bb504486
 4aa9dd8439d7520a7ba6183d50ef08bdf6c781aa465660c93e8195a8d231b62f
-Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93
-9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153
-d
+Output = 7db8c49354861f2d71c8175681c9cc930a00251330b2acc5c321f9833fe
+d4113a1cb3e05a3840082c24e8d49470474dd1c7586f3663f32f66dc3888c63dc0e6
+e
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -210,19 +210,19 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 15b3355179392f40c3d5a15f0d5ffc354e340454ec779f575e4573a3886a
 b5e57e4da2985cea9e32f6d95539ce2c7189e1bd7462e8c5483a
-BlindedElement = 0e7ddd85c8bc5382e908241c6151afe23a41e0396759b5e38a9
-affd996cd822bca242a499793555fc15f07bffdaaa93b42568b307fbdca0f
-EvaluationElement = 4c81e29e8a9502fa02e00cb09cf40d9b98988ac9b4bce7cc
-a0656caeb0926b59c7000d7fe6c5dd814f831864547d2360d223a50077bd04fe
-Proof = 74fc8fbf2e669dc5d25898ea8ce45d1d3eb97edb4b7c3cee39865a3c66da
-6b7bad4ad3e77794d6f5e82fa8a645b9b973a8612bfcd1194302f700ee3433e876d8
-3f96bb70f19ff292605ad4c9466fd71dbc2ed22ade0130574e5ee343ef45d42e834a
-11a19fd6f5b1b5ef910bcccf731b
+BlindedElement = ea3418614d71144ac4ecbd2c63c30ce34718b739ba0a5dd3585
+efd9800b9debdad4cffc25dcc39b4691aaffba19ead8a425d7d50f016f57e
+EvaluationElement = 7e12ab491c3787a1f17118f7a0308f8c41f4cd6e850cf7fa
+ba030b6c1bf1888337149e7c2fc88068626a0107be18e8b9e29f41c8d1510049
+Proof = 91ed184bf518a155749a99d39bed3f9dc9895054e55fab0ebd0ce4270e84
+52fcc8da055e8c2f75f2306ecacaa594de592e0d0b059b8eb30e15d5c3132b71ebc4
+933596c563ee8ce8681e0e40534e92ce487a0e33e341f02a9aaa1f750d9efa7545a0
+008b2f8dde5047ce68d00c2e962e
 ProofRandomScalar = 2f2e9955be83a4b25743ebd3618d4fad8b7288477da50bed
 9befa58af639ddd950fec34205f8a4f166fadcb8fa71a3ffdd2e98f4c8ef5e26
-Output = 2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c
-07f59055e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f
-9
+Output = 66125718c5d651c88ab57dda67c52a506d436600f1521b7684c869b9a2b
+3e67d1b41c47593e79fd6b70aaae8d3689536897ae8964ffcd433c0884c12c94929d
+c
 ~~~
 
 #### Test Vector 3, Batch Size 2
@@ -234,24 +234,24 @@ Blind = 614bb578f29cc677ea9e7aea3e4839413997e020f9377b63c13584156a09
 a46dd2a425c41eac0e313a47e99d05df72c6e1d58e6592577a0d,4c115060bca87db
 7d73e00cbb8559f84cb7a221b235b0950a0ab553f03f10e1386abe954011b7da62bb
 6599418ef90b5d4ea98cc28aff517
-BlindedElement = 5e481a4d7eaa5bab831f53f9a6311851dafd4318c6462eed4f6
-15004afdb082da2f99670b0963985faac21c30eea19aacfc441412edb4c0b,8e043b
-9b7afeafa07e39d9b8b88957ff07d69124b1a2b841e18c9ffb52ebf0c25144eb2501
-a1d7983a44604f33a36e925eebc9bec65d9c54
-EvaluationElement = 8a0d34fdb0b55121421546ff952c7bd3cbe469926ff9ad4f
-aeba243823955529eeae4f1a7a64cd055ec01baa041a99dfbe1a67ca4d59f93d,5e8
-6e0b41cc88186ee0003baa46535e71acd98453b298976b92be2cca2646e88620f55d
-f6bf4754456dfd8d84f6889c17b5ff93052325a1a
-Proof = 1ff624a102b99771c76a9414e9b3f33127897d971bc84a922e464805e4a9
-f27b889922030adebbbd58e0ab618ade9c84bfe8aa226176f11f432958ea1e6f6926
-3aef51db9efb23ee504d233c17e9077c0373401da167637a1df4eafd9c2537c9f89c
-103f9e635931fe2042419dd9bd37
+BlindedElement = 909b0b8bcb900bd9e70f27258d7264015c50f3717361afff22d
+16ad84758d2c6b7a1963263d0d035f63b88df8b473f9365c53abcec34b201,726315
+ee47e217344da7036a24f806177e221c9f6eae5763f9089b16bada69b85aec56c3ca
+83b6f5f1091640ea3fe3e9429ff2aa7772efef
+EvaluationElement = 46d8dec85a27698b4b69a67299eab1da0ec2bbed013a3a59
+b932e2938e2e2c5bcc8274febf49b7903419c18b895f17c4a9a504737d7a3fdc,fe4
+7eca9d06b400c80cc2b749284312c6f97c7b5d88055fe56b068c441e053fe909c6c2
+2bb7cd646a932e2d3838b7b3e2e883cfe0ed1a2a1
+Proof = 1f63637de4f945f5937ac015a508420f119f7b6a8e001439a1923a1705ce
+ee704ad17664ff4c72f89566f83ceccee3001d44d849ac4dad2bc05b9bc718ba787f
+c3c5b09198c4ab244455bac64a9a231b18c4682c0e6e30ae5398f5c041ee2c5b02c6
+19b7497c5bf070fdb4656353de1d
 ProofRandomScalar = a614f1894bcf6a1c7cef33909b794fe6e69a642b20f4c911
 8febffaf6b6a31471fe7794aa77ced123f07e56cc27de60b0ab106c0b8eab127
-Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93
-9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153
-d,2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c07f5905
-5e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f9
+Output = 7db8c49354861f2d71c8175681c9cc930a00251330b2acc5c321f9833fe
+d4113a1cb3e05a3840082c24e8d49470474dd1c7586f3663f32f66dc3888c63dc0e6
+e,66125718c5d651c88ab57dda67c52a506d436600f1521b7684c869b9a2b3e67d1b
+41c47593e79fd6b70aaae8d3689536897ae8964ffcd433c0884c12c94929dc
 ~~~
 
 ## OPRF(P-256, SHA-256)
@@ -261,8 +261,8 @@ d,2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c07f5905
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a78
-27b
+skSm = c15d9e9ab36d495d9d62954db6aafe06d3edabf41600d58f9be0737af2719
+e97
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -272,12 +272,12 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 5d9e7f6efd3093c32ecceabd57fb03cf760c926d2a7bfa265babf29ec98a
 f0d0
-BlindedElement = 03e3c379698da853d9844098fa0ac676970d5ec24167b598714
-cd2ee188604ddd2
-EvaluationElement = 030d8d882120e8fa67ef978a9abac506acd5ec731b8e8d6f
-15035e29241dd2ced2
-Output = ab653a4f3b357177b125e1c6d0bd2c0bc409b7ed5f48c99537fbd7fd11e
-f8133
+BlindedElement = 03e9097c54d2ea05f99424bdf984ea30ecc3614029bd5f1139e
+70c4e1ae3bdbd92
+EvaluationElement = 0202e4d1a338659c211900c39855f30025359928d261e6c9
+558d667b3fbbc811cd
+Output = 15b96275d06b85741f491fe0cad5cb835baa6c39066cbea73132dcf95e8
+58e1c
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -287,12 +287,12 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 825155ab61f17605af2ae2e935c78d857c9407bcd45128d57d338f1671b5
 fcbe
-BlindedElement = 030b40be181ffbb3c3ae4a4911287c43261f5e4034781def69c
-51608f372a02102
-EvaluationElement = 03991df04e3e526d457065b6eafc855aa2fc4528c22d2b51
-6a3c71227b1b488f44
-Output = eca4df985f7c49b091c3ce4217be1f26cdc6a148b681ed1f1638d09dfd2
-13e6e
+BlindedElement = 03fa1ea45dd58d6b516c1252f2791610bf5ff1828c93be8af66
+786f45fb4d14db5
+EvaluationElement = 02657822553416d91bb3d707040fd0d5a0555f5cbae7519d
+f3a297747a3ad1dd57
+Output = e97f3f451f3cfce45a530dec0a0dec934cd78c5b656771549072ee236ce
+070b9
 ~~~
 
 ### Verifiable Mode
@@ -300,10 +300,10 @@ Output = eca4df985f7c49b091c3ce4217be1f26cdc6a148b681ed1f1638d09dfd2
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = 4e7804245a743c59d624457677294e04a8bc4bdcd94f0d3bd54f568067489
-d34
-pkSm = 03b51a0af95c819b09ee80c2056cf0ab0551a5355266d3a0aaff90c3fe915
-ed892
+skSm = 7f62054fcd598b5e023c08ef0f04e05e26867438d5e355e846c9d8788d5c7
+a12
+pkSm = 03d6c3f69cfa683418a533fc52143a377f166e571ae50581abcb97ffd4e71
+24395
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -313,16 +313,16 @@ Input = 00
 Info = 7465737420696e666f
 Blind = cee64d86fd20ab4caa264a26c0e3d42fb773b3173ba76f9588c9b14779bd
 8d91
-BlindedElement = 0222f5dba2da1ec7bd1086d0e04894ef1da1c11163daf376b2b
-c76cc51edb16815
-EvaluationElement = 02f2767135f75f69b257675b38f2bcd50338a655a5092166
-3c8942ca61ea7d3c29
-Proof = ffa082fc9f9a287e7edc50e3ad879ee13aebd24b69124792bdf047c643f7
-0af2b50907b2fa188b90aff3b25e1d9abb02e9e2c8bfdc525c61ca008428940fca64
+BlindedElement = 029e103c4003ab9bf4a42e2003dd180922c8517927a68320058
+178fee56c6ac8a0
+EvaluationElement = 02856ac0748085d250d842b8b8fff6c1a9f688c961de52c4
+a1e6c004c48196a123
+Proof = 2a95bd827cf47873c886967ef6c17fe0e46efddd3b5f639927215cb7592a
+4bf12a29117174a1af5899d64855352690e416b37f2a95580846a6bec445d82364fc
 ProofRandomScalar = 70a5204b2b606f5a28328916e1e5ea5a17862d7a261fdd6d
 959759758d5e34ac
-Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8
-94448
+Output = 14afc50acf64589445991da5b60add8b3f71205d53a983023d3cdaf8c95
+c300d
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -332,16 +332,16 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 5c4b401063eff0bf242b4cd534a79bacfc2e715b2db1e7a3ad4ff8af1b24
 daa2
-BlindedElement = 02f84403d1ceb40a3668349f7c349f806d2c858785853324c66
-7505018d13ee160
-EvaluationElement = 0216d7d342ef50113244b444dfedaec78810959e40fef0a6
-922658d44accb1e9c1
-Proof = f496e58818c25ffb386f22ceb57a83da1200612b67aaa07608b3375c25b2
-97e03e67d1f6094a8012725dc63a0c2f4f870173b97a3daa03588f777655a087fbbf
+BlindedElement = 0323aabcfa93e9570524253671b3ce083144b183cecb562ec8f
+8a8472fc8cf341b
+EvaluationElement = 03087bc7e00b8ad80b8a27484b91f8bf824a5d896a703135
+4edfa3269866493d9f
+Proof = fe55ecc9a92f940d4a56207a58e5554c6976b9425c917d24237b0a35c312
+bdcdea778a5c56690309ff28f26cc8bc5994e85868e3c870e5a32c0a559d80deccb8
 ProofRandomScalar = 3b9217801b5d51cef66d9fdbd94a53533e7c5057e09e2200
 65ea8c257c0dd606
-Output = 90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b9
-2fe28
+Output = 533c79459ee0ffa8844ac37572f3616e10a1074dcbf945ce37b0c651cbb
+5775f
 ~~~
 
 #### Test Vector 3, Batch Size 2
@@ -352,30 +352,30 @@ Info = 7465737420696e666f
 Blind = f0c7822ba317fb5e86028c44b92bd3aedcf6744d388ca013ef33edd36930
 4eda,3b9631be9f8b274d9aaf671bfb6a775229bf435021b89c683259773bc686956
 b
-BlindedElement = 02a840214a74345570dcadfc927e726901b257b447234fac509
-0a1830295ca736c,039a5a8152abb0154b4d79a90486e358ea325980f0bf590524c4
-460f700454238f
-EvaluationElement = 025991aac0b0c79bb1185c0b1e64964656634dfcd755cdf5
-da9ee52be0b5d5f742,03319e3baba8fa7f60dab49ef0ba68b7a85bccb5d4968643e
-2f029b6c0826911d1
-Proof = 51b5ed453168480a2e95863cda1f4d28ad5bc91e8c9c75d788569aea1679
-794a642087db120a2b3ce839f57041801f37cd4a6c05b69b327b877810293f7b09a8
+BlindedElement = 021af4563c31cf1513bc5ae0b89c5b527c7ac70614b9d31c44c
+eb292ab49c91cc4,03f7e7ebe5610710c360df40cbd90dc52c2da500664e879f2afb
+78e71f815abee1
+EvaluationElement = 03c8678cdb95e2f0eac027932c51893a20326b774ef23531
+bcd95def84060d240d,02b68c3891314a9696b5dff5df4b4e5b325938e2c5cb90f5f
+b9ba6a1133aa4dd14
+Proof = 6efbde69d36e3f9d53a79a73ce46d5d8ef31f0df2fb3f6f2c882b21fdf0e
+d76dcd755e42f35f00daaa6e964f48125cf1d642b1cea2e5faa2fb868584a8752bf2
 ProofRandomScalar = 8306b863276ae74049615162a416d507a6532c99c1ea3f03
 d05f6e78dc1edabe
-Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8
-94448,90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b92fe
-28
+Output = 14afc50acf64589445991da5b60add8b3f71205d53a983023d3cdaf8c95
+c300d,533c79459ee0ffa8844ac37572f3616e10a1074dcbf945ce37b0c651cbb577
+5f
 ~~~
 
-## OPRF(P-384, SHA-512)
+## OPRF(P-384, SHA-384)
 
 ### Base Mode
 
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = ef1b52c12cdf43dc260bf5425a30cde7d708ec34b38dcfbdc2946d7baf525
-361e797f6a98f1ebd80f64865f21cde1c6d
+skSm = b9ff42e68ef6f8eaa3b4d15d15ceb6f3f36b9dc332a3473d64840fc7b4462
+6c6e70336bdecbe01d9c512b7e7d7e6af21
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -385,13 +385,12 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 359073c015b92d15450f7fb395bf52c6ea98384c491fe4e4d423b59de7b0
 df382902c13bdc9993d3717bda68fc080b99
-BlindedElement = 02fa3115c21ffcacc09ca470729b725781f84333e217cfeec2b
-8ba6a54ce492ede7ead3714c5b177427ef853effb1b5c24
-EvaluationElement = 033a4bdea2693686e4ce467c8a5cdfc41b86ad20aaaa9bc1
-6e75b59dbd41dab0bc9af0041e551ece3b4c9fb2315d8d1fa9
-Output = a5a0ef3fb964a36097662d1258ef0f93b224ddd81a356c37d5dd05a885a
-0b6722b90c1f5181637fece7ed180ba053da23bf35cef7a87dcba75562cb7a264001
-8
+BlindedElement = 0285d803c65fda56993a296b99e8f4944e45cccb9b322bbc265
+c91a21d2c9cd146212aefbf3126ed59d84c32d6ab823b66
+EvaluationElement = 026061a4ccfe38777e725855c96570fe85303cd70567007e
+489d0aa8bfced0e47579ecbc290e5150b9e84bf25188294f7e
+Output = bc2c3c895f96d769703aec18359cbc0e84b41248559f0bd44f1e5467522
+3c77e00874bbe61c1c320d3c95aee5a8c752f
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -401,13 +400,12 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 21ece4f9b6ffd01ce82082545413bd9bb5e8f3c63b86ae88d9ce0530b01c
 b1c23382c7ec9bdd6e75898e4877d8e2bc17
-BlindedElement = 025fddc89a832089a59120df742acb34dba82b26afcae977961
-57df238b5905c494a23c56b1f485cbbff78d31df7fa1492
-EvaluationElement = 02f8b59813663e7965c219c113c560482cbea7ca4c412a0c
-f3fd855ee7d543ae926d29ace85296f195f988be284b2347f6
-Output = f2a0b355cae4ae2c717d0b48e39c0ee356db3ca446fddf85cddb74f397e
-b85046da62d0d85d55d19d39dd9b68fcc39379ec6d3b93ba33909fcc96361d225cdd
-e
+BlindedElement = 0211dd06e40b902006c33a92dc476a7c708b6b46c990656239c
+d6867ff0be5867d859517eaf7ea9bad10702b80a9dc6bdc
+EvaluationElement = 03a1d34b657f6267b29338592e3c769db5d3fc8713bf2eb7
+238efb8138d5af8c56f9437315a5c58761b35cbfc0e1d2511d
+Output = ee37530d0d7b20635fbc476317343b257750ffb3e83a2865ce2a46e5959
+1f854b8301d6ca7d063322314a33b953c8bd5
 ~~~
 
 ### Verifiable Mode
@@ -415,10 +413,10 @@ e
 ~~~
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3
-skSm = 67ee1c9e67566d87bfcca9e5dac4bfdb8bdd727c031133fac2aa9ba6c41e6
-1e5f8fd401b5d76c7d54b15b15932797479
-pkSm = 029b51b2ce9c499f2056e65e0f41d60960f9c4795c0cf94af273ce840c20b
-e4cdf87690b6b121b37d399b49afcc2ec9ac3
+skSm = 42c4d1c15d27be015844404088967afe48c8ae96d4f00ce48e4d38ecabfb8
+feb5b748de625cdf81ab076745d6211be95
+pkSm = 0389ad5e50eebf9617ae3a5778e4f0665b56aa9066919e1fa5580d8dd781d
+560824e0e78aae816af6eff8abe2ad0585a0d
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -428,18 +426,17 @@ Input = 00
 Info = 7465737420696e666f
 Blind = 102f6338df84c9602bfa9e7d690b1f7a173d07e6d54a419db4a6308f8b09
 589e4283efb9cd1ee4061c6bf884e60a8774
-BlindedElement = 02a1f41323e91a6ac9fbbb5b8e4c7c58a4c5bcbaa4195557182
-cd59e826dc847f1e077de1d402ac92eafe322461fc0d582
-EvaluationElement = 03af3164f8721a57931f92884b43c58ff0ed1be249f7e1c9
-3033a5909f0ffc59ed3fea9452ec5c9cfb865b8bd2e65cd209
-Proof = 44108ca9b342f4d7e31a250aa9f41afb0de840e113dbb6bb82b5e6735aef
-18a20867a63628be6e109d2d687e1faa8888270f1173bc6f916e21142096d23d1719
-4edf844074922c287a50182f87bbb5fc3a966c8851dd6799ec5cfe59c7063c7f
+BlindedElement = 02ae8990d580dcd52b6bc273bc6d0fd25be50b057511b953d9c
+c95bb27cb3e1fd3249ae19744ed496c6e4104ebc1ed48f1
+EvaluationElement = 024cffdae0cae5fa4d6a68246ae797dbe06508284b65e0f0
+9046977ab5d52a8b38f0245607db74979e5276fc636332cdee
+Proof = 128ad4f987ce1e3a9aab1e487df15d8c8000d5c4c9f14bd7fd699fabdb8d
+a3f577d91625fabb0d9cf6069f8af6d9cc232dd63cd161be84a1e146e0110dc741e6
+26a082193aa0a26e03118b662f1b903667f6e6fba51d69a2d65982a3b64ecb35
 ProofRandomScalar = 90f67cafc0ffaa7a1e1d1ced3c477fea691e696032c8709c
 86cbcda2b184ad0029d29abeabede9788d11782429bff297
-Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51
-eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe
-0
+Output = 8a0b4829bc8422b1a2301d5471256892883c5e3fe27b998d1010225a706
+545637336a20a76f842d8a22e591d382c77e4
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -449,18 +446,17 @@ Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
 Info = 7465737420696e666f
 Blind = 8aec1d0c3d16afd032da7ba961449a56cec6fb918e932b06d5778ac7f67b
 ecfb3e3869237f74106241777f230582e84a
-BlindedElement = 02b3465d70f76de3eaf6ecb8080490288f741c622c06d023bd1
-80a55a2e3e4eaad08533651f9d278a3f59cec8277780303
-EvaluationElement = 03a53e01901893585437cd48a1eea1188fc8e9275a80cf43
-370a451c476dae3b84ca8c7bf44fcac2fa3eeab933b25da0c3
-Proof = 5ebc467e78ae29f7d741221df0ee67285df72ec482fdc8e5bde7e588b12f
-cba86f4f116c23ee6b32c0f38f2daac67e869e53e7e0494cc883e4984daf10a55819
-bbb5ce7e9005f143b3dda88d8a35649269a4658a98c81c814097d15a3dcf4dbe
+BlindedElement = 02a384f2d9635adffcc5482344c519036c019f3cc0918ec737c
+67cdda10ac0f73a9fe348835531f1900ea2c1f06dacdce4
+EvaluationElement = 0306f0f71b58d53ae0973538a7bf2ce8fba7143efc88d2ef
+ca6cf1f98fb8399b16840d1fbbe7897807db930f67916418ae
+Proof = 2c47297ee0093061ca2c87b430b2851a860aaae76c2bdba48779ba4294e7
+de0556ede3e6b881a04970b68a6126e2fa197d69e6784fbbd173604501c0edd21696
+628f0fd7cb13be28f94e5e15c042ffccadd780b2448d7d9d528e9615e4e70539
 ProofRandomScalar = bb1876a7f7165ac7ec79bfd5213ea2e374252f29a6e19915
 f81b0c7dcea93ce6580e089ede31c1b6b5b33494581b4868
-Output = 5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920
-267a40b246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92
-c
+Output = 8c52d40c1f6cc80208bd610178a5034d6c4a05584e19b69617f846b09a8
+545443c63c8aa4d85bf0aad368e0591b1216a
 ~~~
 
 #### Test Vector 3, Batch Size 2
@@ -471,23 +467,22 @@ Info = 7465737420696e666f
 Blind = 41fabd4722d92472d858051ce9ad1a533176a862c697b2c392aff2aeb77e
 b20c2ae6ba52fe31e13e03bf1d9f39878b23,51171628f1d28bb7402ca4aea6465e2
 67b7f977a1fb71593281099ef2625644aee0b6c5f5e6e01a2b052b3bd4caf539b
-BlindedElement = 02d715dfce1a0724071fa8e530d79f7b234a31739a64166e0fe
-21fa6fa0fe19e1ab5e468becca899f31e365c47f3efb2ef,028dfd0c7a38b4cb8477
-cae34f041344fb44fc9e55bfa3cf55ab7b4764b74accc7b49c0ff09a524598033dad
-1152fb3a1c
-EvaluationElement = 03f9a8c81c108201888eb86348c6f80691d99425272972b5
-bf41d3038af0eeb04d60edd9ea288625a7166a8c17cea0083f,02abb31980533dbf7
-eb5fee0a8969089b3e16585a2cd41a34067592a2021b1b4ea3d1cef3e7c87a6f284c
-0e45546c92d98
-Proof = f0f7bd2723c3460d5c5ab03092c6861fb34253470ef430dac9aeac6ce489
-84b28d91178061cba02e3e911c4aa97229d519755db385ddd08064fdf8405897d1de
-a472688934088505e89dcff91081fec1d2e37c1d4c5a9dddbdd358aa89f63b46
+BlindedElement = 02d4e6186c9ffa92565055f43f27bb1e2c4103c3325bba0b499
+adb99a157987d20fb374096814e438a6b483efa8f2a3307,033a3b052416a8a6d842
+a0baea6f5fab99d36645a70c89897a536970d34038eca35afac24906294cb7925b1b
+05e4327c8f
+EvaluationElement = 037bf8e28a0607b1f8aa59363380b5a7450b66b98017cf03
+3797f6c6c74e7625a445f71ace1bea7836ea5baa75d54eb5bd,03b793a9cb2d76991
+f1d6cd822abfbfa89fdfa1a06ef42b0bc8ade161e1996ed08c288a08366d4140c762
+7bba4e3472bcf
+Proof = 27240901b6855d2b58ce84afefa91dd11819d7d5df73f94865a9d7e19020
+41200eb732b60b57fa0daf6e456402bb1ccb1aed901af35d3d790cd7c618604b766b
+b9271010354da9e4e5507e0468adf177977143db2ddb94d9b70e837ad7578275
 ProofRandomScalar = 1b538ff23749be19e92df82df1acd3f606cc9faa9dc7ab25
 1997738a3a232f352c2059c25684e6ccea420f8d0c793fa0
-Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51
-eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe
-0,5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920267a40b
-246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92c
+Output = 8a0b4829bc8422b1a2301d5471256892883c5e3fe27b998d1010225a706
+545637336a20a76f842d8a22e591d382c77e4,8c52d40c1f6cc80208bd610178a503
+4d6c4a05584e19b69617f846b09a8545443c63c8aa4d85bf0aad368e0591b1216a
 ~~~
 
 ## OPRF(P-521, SHA-512)
@@ -498,9 +493,9 @@ eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = 016ee706f30ce7e15e4ffa3114c7d59a7b6f302d531ca60419be39d1cd43e
-e13b1fc8398b7f63a900cdc49c6e99f65a74403db2fa739927a2ee288cff857d9d84
-ecf
+skSm = 00a2f8572ee764d2ec34363fb62ef9e8ff48883b5357b6802f43fffe5c5fd
+0d11f766bf7086aab33e2dce02cc71d77250ef6ed360a3fd56244abb6bdbc3aa6534
+da1
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -511,15 +506,15 @@ Info = 7465737420696e666f
 Blind = 01b983705fcc9a39607288b935b0797ac6b3c4b2e848823ac9ae16b3a3b5
 816be03432370deb7c3c17d9fc7cb4e0ce646e04e42d638e0fa7a434ed340772a8b5
 d626
-BlindedElement = 0301f0a8c68e58f5571bd39fe3b0b2aa055a8c34e3d68ba0d2e
-d177db0bc7575d477ed8f557596feb5ac568fe738eee8cff7dcb56dc78f52bf381c0
-912e0e84b5a3f5b
-EvaluationElement = 0200d7b1131aa9f8c365de7bd7903738f61bdecfaada375a
-ba3905bdaad1301c7cd537f69abff04140ccca29a4c46cb4a036160e55a9621210b3
-71d84646b0199571fa
-Output = 61eea8fedfa9338dd22fac279f1f3f9e96693919c59ea3918c7a441115e
-6bdecb1d05b5da55d4024858c92d3911a81d4eca362123b2911e5dc58591bf7be29c
-7
+BlindedElement = 03006ce4a27e778a624d943cf4db48f9d393d3d4dd9cd44b78a
+cf2d5b668a12f0ca587962de8c82b5aaa1f0166eb60d511f060aaab895fc6c519332
+77bc945add6d74a
+EvaluationElement = 030055f7cd3ee3b1734e73ad8bbd4baca72ae8d051160c27
+7ee329f23fa2365f9f138b38e6e2c59cc287242eeca01fae83d0c7cc3bb19724ac59
+8a188816e7cfe1ca88
+Output = aa59060a41ec8ca7b6c47f9c5a31883a44ffd95869a09dbe845ea8ce20c
+b290dba0b57c505824a0dcf6f961a2baeb8e6b49df8c158761a3fdb46f39e8e7fcb8
+b
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -530,15 +525,15 @@ Info = 7465737420696e666f
 Blind = 01a03b1096b0316bc8567c89bd70267d35c8ddcb2be2cdc867089a2eb5cf
 471b1e6eb4b043b9644c8539857abe3a2022e9c9fd6a1695bbabe8add48bcd149ff3
 b841
-BlindedElement = 030099c35342a43221c6e03debfb17bad71b62e04c9242aa6e9
-f2f915163ef4f5b8b7fe1740a4d636c36bd5c73ca39c69992dc7f6dff8f232125efc
-22af4df8352fea2
-EvaluationElement = 0300ceeba6751486eecc479ab2259e3a57c13b0710f61c82
-87acad60624974b76ea242dbcae3a9daad1bdc9c49012c8d8b384d510980cc1ef8fa
-8d10502748ce63d93f
-Output = 6682273a5199b2454a706cac557008e2264580ac39b6995e1f47130b985
-d1015de7713d3bdb121212a68de2ece73bf72e41738a01c23428753c44e3dd39b5de
-3
+BlindedElement = 0201459ba64ad0e0f9f689f0ad5ab29ca5b960f5c9da3aef412
+6d2d547b871e754b17971fd45e0d64bdcfc8d256c342a141f04e2640705c38936c8c
+f53c22ea6b13966
+EvaluationElement = 030094036457e8e5bf77719b11f01dd4aa2959efdb3329c3
+e3b25493efc3ab572c2e7db104cd5922645320ef51bbb282f84e5f6b08e9b49354f9
+d6a9f3a4327a1de6e4
+Output = 5efe6f00f45ec4e87e4c9b89aeaec61313c15c0a0a21ee2e41362d6af54
+536adf2f68d23c729b92b6fa8d5611764b0272be6cc153d47a0256c8cb44bd740037
+a
 ~~~
 
 ### Verifiable Mode
@@ -547,12 +542,12 @@ d1015de7713d3bdb121212a68de2ece73bf72e41738a01c23428753c44e3dd39b5de
 seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
 3a3
-skSm = 0017674057e06c5e3e8a331f2dc3558540701c9cd0f4c19126d5972af6a01
-447b312d05a06dab3e9e07c891d749444c27ede0897ad42aea03b887eb5db93e3f29
-a86
-pkSm = 0201ee4e2eaa74728f577f4bb282c5440cd454fdee1d79b15a36d34b5e5a1
-25e3ccc0f99e32cc0a6a15b5652a0c8a424860c6753f685d0e1e150ceba24ca3386f
-29216
+skSm = 0064799c2f9c0f9e6b9ac2aca5c42687cf15742fb73e086c4954aa0bdc8b8
+25911ff03712e8d308c0a6ff5435375036f189391234bf21aac57fa73df155d70da4
+7bd
+pkSm = 03013e587a7750213bb7c2b338a4507635f1ba60ece346de32ad975373e56
+fbabd878f9956996aac83a550ed5f5ba98fcc56817f6230cc7e84cb7eb2a1e1db51d
+bfc1b
 ~~~
 
 #### Test Vector 1, Batch Size 1
@@ -563,22 +558,22 @@ Info = 7465737420696e666f
 Blind = 00bbb82117c88bbd91b8954e16c0b9ceed3ce992b198be1ebfba9ba970db
 d75beefbfc6d056b7f7ba1ef79f4facbf2d912c26ce2ecc5bb8d66419b379952e96b
 d6f5
-BlindedElement = 0200357f949a0a0bdfeb682734dbdeb778f3845045617b21436
-27753332e2e75458ab183b12635c75e19afaf56981e7755803026842db1b22fa42c8
-61413d07ff86545
-EvaluationElement = 0201d636bac3f77c1091b337daae32259a3eacd57e3c0fb1
-444fe5ce22af6acdcef4a46a2b5e169aa8d0e26ec2a3621c15dd366ba1978dae761c
-1ef3dac63c60cbee88
-Proof = 011ebe27ebc79e5679b643c6b3a51333499c7abee86c092181c0a8e7e539
-e0ba30b1c128666708c753696ace2aa789c4975b0b80d6241a1dafe85c39a7338d1e
-20d00131c8a81b5f64209f8fe53e8c6a00789a893f20596198e2521275e05d925298
-08e9f54030fc8be2ce78c6df0d29e6fd7d8e623e0ccc7b19b194493dacd2a4eb3a32
+BlindedElement = 02002ff3ef3f2411aa0358936f852be710af790c9affbced8c3
+9b018fd97de0a45d80c66cbf0dbda690ee4f594e0795627e6c6f37a500f223c30f31
+c24e73501532e7c
+EvaluationElement = 0300769fd56c5174c4e3922900fcefdd5a89c9592f4d8e8f
+2396678fa72c01d4f8551ec92d4b5287ca673dc29d8db9bb05d2396121a6b8732b68
+ebf310fc2620059d67
+Proof = 011fd92f54f6a955a333648d843807bd88f644d235a7d592189da42d721e
+a6f7b55ec813146f35982487910aa15bbf5ce90653edb6a1b48c0bfd15758e9358aa
+731601baa67a3a59db301f41caa020986ae9e93a80d6c06d92e8c5eef6056fa6f342
+6b6054d118dc9fecb77fdcb4fc86b9857ada6de18394ff7d6c574cbd08d746b9dde0
 ProofRandomScalar = 00ce4f0d824939827888f4c28773466f3c0a05741260040b
 c9f302a4fea13f1d8f2f6b92a02a32d5eb06f81de7960470f06169bee12cf47965b7
 2a59946ca3879670
-Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8
-79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29
-5
+Output = a647c5a940aa19d767ab0e163d1357ca068206b2b78f9e8e1021c0bb0f3
+27d20cb8fadf996199d86d4cc0a08ac314493319979e1c2a98a96085b8fabff9f0d0
+7
 ~~~
 
 #### Test Vector 2, Batch Size 1
@@ -589,22 +584,22 @@ Info = 7465737420696e666f
 Blind = 009055c99bf9591cb0eab2a72d044c05ca2cc2ef9b609a38546f74b6d688
 f70cf205f782fa11a0d61b2f5a8a2a1143368327f3077c68a1545e9aafbba6a90dc0
 d40a
-BlindedElement = 030185e431f056e75ba7fac49da70790031daa333d16f05e1de
-471e24afe0ed985c770ce77bd1bebec527e9a76feecc6afd92c5fd00481ba7fb843d
-2aab52337cb716e
-EvaluationElement = 02000859e1abc2ed28086b854ec5ae72311244fdeedf81d7
-69af6a6f2c83f00fa48df1f1a0c0b6fac84cc654b7757ac042107a6b3043e483bb3b
-74de5d6c301b20e8f6
-Proof = 01629dd5af14c7414801d879b1018ce06bcc5c5d0a64ca422b76aaa531c8
-ecca630919fb4b51fa60fdc215f73e67e8d617d55ca6a227343d434d5e0f487567f8
-5bfa016959443267bb7d9a5c5e5b1c4d20026394b4edaca7dfbc1aa3b3c2020cf995
-79cf276c0e84f0cb5a820226fa3b81d42de2db39d8412642e70428e485a61ee9d760
+BlindedElement = 0301e2ecf7313820e9d47763e12633ce6acf9b3dec89928c83b
+de1ede2180dc73553af1317408846af5c53ebfed00d19a4125f4ffb7df9f4260ccc0
+84a6f7482414a9d
+EvaluationElement = 02000e69591ab605652cb3310e774edf79417e102cf89005
+c2c7f2bd3a06060d740817802f2cf484748d93df5b281a4bd835617a97ec9809519d
+474ca53bba15cdf014
+Proof = 0076fa4275414acb9f87dc9e4f20971d51fcd0d38a980854ac2ad1bd5737
+eec23bfb4599d021881f7b3872d2e90d9b47e4219f490cf7f0235b2f0859cb2ef15d
+dfd401acb6b0844edf066a5767b4b85536bfee69bdf472acf7a59254cf6578f9f35e
+ba51bb58c6428d6b7c9e5c9af97edc66d98886fda9544048bf9ceea6fc745bf970da
 ProofRandomScalar = 00b5dfc19eb96faba6382ec845097904db87240b9dd47b1e
 487ec625f11a7ba2cc3de74c5078a81806f74dd65065273c5bd886c7f87ff8c5f39f
 90320718eff747e3
-Output = 7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d
-1b2e936669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c13011057
-1
+Output = 8d109503ccced41cbec087dab86c607763020be93bdd5ec8508cb078607
+1a2b22a7b06150242bcaf6ea1b555a994e0266647eb72914caf73cabe53ddfb0f940
+d
 ~~~
 
 #### Test Vector 3, Batch Size 2
@@ -617,26 +612,26 @@ ae9b4703e17e559ca3ccd1944f9a70536c175f11a827452672b60d4e9f89eba28104
 6e29,00cba1ba1a337759061965a423d9d3d6e1e1006dc8984ad28a4c93ecfc36fc2
 171046b3c4284855cfa2434ed98db9e68a597db2c14728fade716a6a82d600444b26
 e
-BlindedElement = 0301978860af75cd69acbc93e8c9fc530e5d2b2208da42c65bf
-e079f0f6e0b3fc6080556c10739271d2a8fe578409d4fa9b19ef0484d9c15451c4e7
-0501e31da7608cb,0200e30565c3d7e02c822762f25db4c872811adb2cbfbad92b04
-291bc8c476d0546d1c5ecf5c58ff06b8d19aad8eca9e5f1a80ff8e981ebc490b0cfb
-d5d499b47bad8e
-EvaluationElement = 0300abdee910f144c3be460e724c11626e1f9986f72e2c43
-3a9c4dad2ef6fcb9249c9a5036334ba88b0892462b6f8ad419c38cc259b0c774a9bd
-0c4d545d0914413ea2,02019696f91dcc178bbe6b97f822cdc4052f9b94852ff6023
-f6068848f867df40e54a5f1525e7fafa383e82fe36bf3c74427b51903032d0f89876
-05bf24ee003f37693
-Proof = 008fa896b69c1efc4e9c6bdfd0b149444532d5ba3bfd957cf7cd71c374d3
-a1cca25f17b60616164377b0734243bc878e17d3ecab36b3e3565b5c6218dae92d40
-c0be018707381f6f4b0153044737030b5d9851c15609532da8932c1fa1f4901dba05
-a4118d25142344f9ea1465c907eb13d908a45d8b98265eac48819a04cae859b0643a
+BlindedElement = 0201e22c01df5ac0502842fad603f7a1e1183bcc79a5cb04bb7
+befdea870a9a6ea96fbccd752ea9927a9e1e28438098f693461e81832a3f690616bf
+983fced079f3a33,0300b49216dd8ba5ba1275d8345679f70fbc6baf4f4b32a03e91
+7165a18afa9fad849c48eecb4bae965057ef7c215b52b42ca53c8d5f650633e0bb70
+97f2bd809d09ea
+EvaluationElement = 03002949c2478249b918a0cf2cd870226541a81d2f3e88c4
+7119f732301e749c3dea317c11174a18b89d1b9d2aa4f6ae92ae724e03a4800a26b7
+c827b00199f1114bcd,0300924ab017ea6e6328a0b0f341bbeb7d209c67ac169fa4e
+f7b04055c66b92aa9657f5d83b0b1ee9c79f3f0198519c97fef07dbecf3f6d477755
+0242a1c87953f9461
+Proof = 01f5d3c3f835d91aa88202f0fe8728180eeffe7fbc66ffe3f7a7dd958696
+a7cd3d47b3c0ec6cd59e9ee23090137293e6f42269923f3d4a1659bc706fd9762070
+7d230028cd4b0aa237b91a352fce81248936826ba99e7bd5103a871715126014b8d4
+7447e5f20192ed377a7431516fbd82763098ba23f9d15b84fe24fb1126beb0d46f03
 ProofRandomScalar = 00d47b0d4ca4c64825ba085de242042b84d9ebe3b2e9de07
 678ff96713dfe16f40f2c662a56ed2db95e1e7bf2dea02bd1fa76e953a630772f68b
 53baade9962d1646
-Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8
-79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29
-5,7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d1b2e936
-669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c130110571
+Output = a647c5a940aa19d767ab0e163d1357ca068206b2b78f9e8e1021c0bb0f3
+27d20cb8fadf996199d86d4cc0a08ac314493319979e1c2a98a96085b8fabff9f0d0
+7,8d109503ccced41cbec087dab86c607763020be93bdd5ec8508cb0786071a2b22a
+7b06150242bcaf6ea1b555a994e0266647eb72914caf73cabe53ddfb0f940d
 ~~~
 "#;

src/voprf.rs

@@ -36,7 +36,7 @@ static STR_SEED: &[u8; 5] = b"Seed-";
 static STR_CONTEXT: &[u8] = b"Context-";
 static STR_COMPOSITE: &[u8; 10] = b"Composite-";
 static STR_CHALLENGE: &[u8; 10] = b"Challenge-";
-static STR_VOPRF: &[u8; 8] = b"VOPRF07-";
+static STR_VOPRF: &[u8; 8] = b"VOPRF08-";
 
 /// Determines the mode of operation (either base mode or
 /// verifiable mode)
@@ -885,7 +885,7 @@ fn compute_composites<G: Group, H: BlockInput + Digest>(
 }
 
 /// Generates the contextString parameter as defined in
-/// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html>
+/// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html>
 fn get_context_string<G: Group>(mode: Mode) -> Result<GenericArray<u8, U11>, InternalError> {
     Ok(GenericArray::from(*STR_VOPRF)
         .concat(i2osp::<U1>(mode as usize)?)