Publishing v0.5 (#133)

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/main.yml

@@ -4,7 +4,7 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, repoened, synchronize]
+    types: [opened, reopened, synchronize]
 
 jobs:
   cargo-audit:
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Cache cargo-audit
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/.crates.toml
@@ -24,7 +24,7 @@ jobs:
         run: cargo install cargo-audit
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run cargo audit
         run: cargo audit -D warnings
@@ -47,7 +47,7 @@ jobs:
     name: test
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install ${{ matrix.toolchain }} toolchain
         uses: actions-rs/toolchain@v1
@@ -99,8 +99,8 @@ jobs:
           - --features danger
           - --features serde
     steps:
-      - uses: actions/checkout@v3
-      - uses: hecrj/setup-rust-action@v1
+      - uses: actions/checkout@v4
+      - uses: hecrj/setup-rust-action@v2
       - run: rustup target add ${{ matrix.target }}
       - run: cargo build --verbose --target=${{ matrix.target }} --no-default-features ${{ matrix.frontend_feature }} ${{ matrix.backend_feature }}
 
@@ -110,7 +110,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install stable toolchain
         uses: actions-rs/toolchain@v1
@@ -140,7 +140,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install nightly toolchain
         uses: actions-rs/toolchain@v1
@@ -161,7 +161,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/.crates.toml
@@ -170,10 +170,10 @@ jobs:
           key: taplo
 
       - name: Install Taplo
-        run: cargo install taplo-cli
+        run: cargo install taplo-cli --locked
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run Taplo
         run: taplo fmt --check

.github/workflows/publish.yml

@@ -10,9 +10,10 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
+        rust: [stable]
 
     steps:
-    - uses: hecrj/setup-rust-action@v1
+    - uses: hecrj/setup-rust-action@v2
       with:
         rust-version: ${{ matrix.rust }}
     - uses: actions/checkout@master

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.5.0 (March 6, 2024)
+* Just a version bump from v0.5.0-pre.7
+
+## 0.5.0-pre.7 (January 11, 2024)
+* Updated to be in sync with RFC 9497
+
+## 0.5.0-pre.6 (July 24, 2023)
+* Updated curve25519-dalek dependency to 4
+
 ## 0.5.0-pre.5 (June 27, 2023)
 * Updated curve25519-dalek dependency to 4.0.0-rc.3
 

Cargo.toml

@@ -9,7 +9,7 @@ name = "voprf"
 readme = "README.md"
 repository = "https://github.com/facebook/voprf/"
 rust-version = "1.65"
-version = "0.5.0-pre.5"
+version = "0.5.0"
 
 [features]
 alloc = []
@@ -21,7 +21,7 @@ serde = ["generic-array/serde", "dep:serde"]
 std = ["alloc"]
 
 [dependencies]
-curve25519-dalek = { version = "=4.0.0-rc.3", default-features = false, features = [
+curve25519-dalek = { version = "4", default-features = false, features = [
   "rand_core",
   "zeroize",
 ], optional = true }
@@ -53,6 +53,10 @@ p384 = { version = "0.13", default-features = false, features = [
   "hash2curve",
   "voprf",
 ] }
+p521 = { version = "0.13.3", default-features = false, features = [
+  "hash2curve",
+  "voprf",
+] }
 proptest = "1"
 rand = "0.8"
 regex = "1"

README.md

@@ -3,7 +3,7 @@ An implementation of a (verifiable) oblivious pseudorandom function (VOPRF)
 
 A VOPRF is a verifiable oblivious pseudorandom function, a protocol between a client and a server. The regular (non-verifiable) OPRF is also supported in this implementation.
 
-This implementation is based on the [Internet Draft for VOPRF](https://github.com/cfrg/draft-irtf-cfrg-voprf).
+This implementation is based on [RFC 9497](https://www.rfc-editor.org/rfc/rfc9497).
 
 Documentation
 -------------
@@ -16,7 +16,7 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-voprf = "0.5.0-pre.4"
+voprf = "0.5"
 ```
 
 ### Minimum Supported Rust Version

src/ciphersuite.rs

@@ -22,7 +22,7 @@ where
         IsLess<U256> + IsLessOrEqual<<Self::Hash as BlockSizeUser>::BlockSize>,
 {
     /// The ciphersuite identifier as dictated by
-    /// <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
+    /// <https://www.rfc-editor.org/rfc/rfc9497>
     const ID: &'static str;
 
     /// A finite cyclic group along with a point representation that allows some

src/common.rs

@@ -155,7 +155,7 @@ where
     <CS::Hash as OutputSizeUser>::OutputSize:
         IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
 {
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html#section-2.2.1
+    // https://www.rfc-editor.org/rfc/rfc9497#section-2.2.1
 
     let (m, z) = compute_composites::<CS, _, _>(Some(k), b, cs, ds, mode)?;
 
@@ -218,7 +218,7 @@ where
     <CS::Hash as OutputSizeUser>::OutputSize:
         IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
 {
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html#section-2.2.2
+    // https://www.rfc-editor.org/rfc/rfc9497#section-2.2.2
     let (m, z) = compute_composites::<CS, _, _>(None, b, cs, ds, mode)?;
     let t2 = (a * &proof.s_scalar) + &(b * &proof.c_scalar);
     let t3 = (m * &proof.s_scalar) + &(z * &proof.c_scalar);
@@ -287,7 +287,7 @@ where
     <CS::Hash as OutputSizeUser>::OutputSize:
         IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
 {
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html#section-2.2.1
+    // https://www.rfc-editor.org/rfc/rfc9497#section-2.2.1
 
     let elem_len = <CS::Group as Group>::ElemLen::U16.to_be_bytes();
 
@@ -513,7 +513,7 @@ impl<L: ArrayLength<u8>> Dst<L> {
     {
         let par_1 = par_1.into();
         // Generates the contextString parameter as defined in
-        // <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
+        // <https://www.rfc-editor.org/rfc/rfc9497#section-3.1>
         let par_2 = GenericArray::from(STR_OPRF)
             .concat([mode.to_u8()].into())
             .concat([b'-'].into());

src/group/elliptic_curve.rs

@@ -38,7 +38,7 @@ where
     type ScalarLen = FieldBytesSize<Self>;
 
     // Implements the `hash_to_curve()` function from
-    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
+    // https://www.rfc-editor.org/rfc/rfc9380.html#section-3
     fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
         H: BlockSizeUser + Default + FixedOutput + HashMarker,

src/group/mod.rs

@@ -27,7 +27,7 @@ use zeroize::Zeroize;
 use crate::{InternalError, Result};
 
 /// A prime-order subgroup of a base field (EC, prime-order field ...). This
-/// subgroup is noted additively — as in the draft RFC — in this trait.
+/// subgroup is noted additively — as in the RFC — in this trait.
 pub trait Group {
     /// The type of group elements
     type Elem: ConstantTimeEq

src/group/ristretto.rs

@@ -44,7 +44,7 @@ impl Group for Ristretto255 {
     type ScalarLen = U32;
 
     // Implements the `hash_to_ristretto255()` function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+    // https://www.rfc-editor.org/rfc/rfc9380.html#appendix-B
     fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
         H: BlockSizeUser + Default + FixedOutput + HashMarker,
@@ -59,7 +59,7 @@ impl Group for Ristretto255 {
     }
 
     // Implements the `HashToScalar()` function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1
+    // https://www.rfc-editor.org/rfc/rfc9497#section-4.1
     fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
         H: BlockSizeUser + Default + FixedOutput + HashMarker,

src/group/tests.rs

@@ -17,6 +17,7 @@ use crate::{Error, Group, Result};
 fn test_group_properties() -> Result<()> {
     use p256::NistP256;
     use p384::NistP384;
+    use p521::NistP521;
 
     #[cfg(feature = "ristretto255")]
     {
@@ -32,6 +33,9 @@ fn test_group_properties() -> Result<()> {
     test_identity_element_error::<NistP384>()?;
     test_zero_scalar_error::<NistP384>()?;
 
+    test_identity_element_error::<NistP521>()?;
+    test_zero_scalar_error::<NistP521>()?;
+
     Ok(())
 }
 

src/lib.rs

@@ -9,9 +9,7 @@
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!
 //! Note: This implementation is in sync with
-//! [draft-irtf-cfrg-voprf-19](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-19.html),
-//! but this specification is subject to change, until the final version
-//! published by the IETF.
+//! [RFC 9497](https://www.rfc-editor.org/rfc/rfc9497).
 //!
 //! # Overview
 //!
@@ -512,7 +510,7 @@
 //! and [PoprfClient] are used, and that each of the functions accept an
 //! additional (and optional) info parameter which represents the public input.
 //! See
-//! <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html#name-poprf-public-input>
+//! <https://www.rfc-editor.org/rfc/rfc9497#name-poprf-public-input>
 //! for more detailed information on how this public input should be used.
 //!
 //! # Features

src/oprf.rs

@@ -427,6 +427,7 @@ mod tests {
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
         use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -454,6 +455,13 @@ mod tests {
         zeroize_oprf_client::<NistP384>();
         zeroize_oprf_server::<NistP384>();
 
+        base_retrieval::<NistP521>();
+        base_inversion_unsalted::<NistP521>();
+        server_evaluate::<NistP521>();
+
+        zeroize_oprf_client::<NistP521>();
+        zeroize_oprf_server::<NistP521>();
+
         Ok(())
     }
 }

src/poprf.rs

@@ -720,7 +720,7 @@ where
     )?;
 
     Ok(blinds
-        .zip(messages.into_iter())
+        .zip(messages)
         .map(|(blind, x)| x.0 * &CS::Group::invert_scalar(blind)))
 }
 
@@ -967,6 +967,7 @@ mod tests {
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
         use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -994,6 +995,13 @@ mod tests {
         zeroize_verifiable_client::<NistP384>();
         zeroize_verifiable_server::<NistP384>();
 
+        verifiable_retrieval::<NistP521>();
+        verifiable_bad_public_key::<NistP521>();
+        verifiable_server_evaluate::<NistP521>();
+
+        zeroize_verifiable_client::<NistP521>();
+        zeroize_verifiable_server::<NistP521>();
+
         Ok(())
     }
 }

src/serialization.rs

@@ -307,11 +307,11 @@ fn deserialize_scalar<G: Group>(input: &mut &[u8]) -> Result<G::Scalar> {
 }
 
 trait SliceExt {
-    fn take_ext(self: &mut &Self, take: usize) -> Option<&Self>;
+    fn take_ext<'a>(self: &mut &'a Self, take: usize) -> Option<&'a Self>;
 }
 
 impl<T> SliceExt for [T] {
-    fn take_ext(self: &mut &Self, take: usize) -> Option<&Self> {
+    fn take_ext<'a>(self: &mut &'a Self, take: usize) -> Option<&'a Self> {
         if take > self.len() {
             return None;
         }
@@ -391,6 +391,7 @@ mod test {
 
             let _ = $item::<p256::NistP256>::deserialize(&$bytes[..]);
             let _ = $item::<p384::NistP384>::deserialize(&$bytes[..]);
+            let _ = $item::<p521::NistP521>::deserialize(&$bytes[..]);
         };
     }
 

src/tests/cfrg_vectors.rs

@@ -7,24 +7,21 @@
 // licenses.
 
 //! The VOPRF test vectors taken from:
-//! https://github.com/cfrg/draft-irtf-cfrg-voprf/blob/draft-irtf-cfrg-voprf-19/draft-irtf-cfrg-voprf.md
+//! https://www.rfc-editor.org/rfc/rfc9497#appendix-A
 
 pub(crate) const VECTORS: &str = r#"
-## ristretto255-SHA512
+A.1.  ristretto255-SHA512
 
-### OPRF Mode
+A.1.1.  OPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
    skSm = 5ebcea5ee37023ccb9fc2d2019f9d7737be85591ae8652ffa9ef0f4d37063
    b0e
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.1.1.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
    6706
@@ -35,11 +32,9 @@ d8cc917ea0869c7e
    Output = 527759c3d9366f277d8c6020418d96bb393ba2afb20ff90df23fb770826
    4e2f3ab9135e3bd69955851de4b1f9fe8a0973396719b7912ba9ee8aa7d0b5e24bcf
    6
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.1.1.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
    6706
@@ -50,11 +45,9 @@ EvaluationElement = b4cbf5a4f1eeda5a63ce7b77c7d23f461db3fcab0dd28e4e
    Output = f4a74c9c592497375e796aa837e907b1a045d34306a749db9f34221f7e7
    50cb4f2a6413a6bf6fa5e19ba6348eb673934a722a7ede2e7621306d18951e7cf2c7
    3
-~~~
 
-### VOPRF Mode
+A.1.2.  VOPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -62,11 +55,9 @@ skSm = e6f73f344b79b379f1a0dd37e07ff62e38d9f71345ce62ae3a9bc60b04ccd
    909
    pkSm = c803e2cc6b05fc15064549b5920659ca4a77b2cca6f04f6b357009335476a
    d4e
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.1.2.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
    6706
@@ -81,11 +72,9 @@ ProofRandomScalar = 222a5e897cf59db8145db8d16e597e8facb80ae7d4e26d98
    Output = b58cfbe118e0cb94d79b5fd6a6dafb98764dff49c14e1770b566e42402d
    a1a7da4d8527693914139caee5bd03903af43a491351d23b430948dd50cde10d32b3
    c
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.1.2.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
    6706
@@ -100,11 +89,9 @@ ProofRandomScalar = 222a5e897cf59db8145db8d16e597e8facb80ae7d4e26d98
    Output = 8a9a2f3c7f085b65933594309041fc1898d42d0858e59f90814ae90571a
    6df60356f4610bf816f27afdd84f47719e480906d27ecd994985890e5f539e7ea74b
    6
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.1.2.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
    6706,222a5e897cf59db8145db8d16e597e8facb80ae7d4e26d9881aa6f61d645fc0
@@ -123,11 +110,9 @@ Output = b58cfbe118e0cb94d79b5fd6a6dafb98764dff49c14e1770b566e42402d
    a1a7da4d8527693914139caee5bd03903af43a491351d23b430948dd50cde10d32b3
    c,8a9a2f3c7f085b65933594309041fc1898d42d0858e59f90814ae90571a6df6035
    6f4610bf816f27afdd84f47719e480906d27ecd994985890e5f539e7ea74b6
-~~~
 
-### POPRF Mode
+A.1.3.  POPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -135,11 +120,9 @@ skSm = 145c79c108538421ac164ecbe131942136d5570b16d8bf41a24d4337da981
    e07
    pkSm = c647bef38497bc6ec077c22af65b696efa43bff3b4a1975a3e8e0a1c5a79d
    631
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.1.3.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Info = 7465737420696e666f
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
@@ -155,11 +138,9 @@ ProofRandomScalar = 222a5e897cf59db8145db8d16e597e8facb80ae7d4e26d98
    Output = ca688351e88afb1d841fde4401c79efebb2eb75e7998fa9737bd5a82a15
    2406d38bd29f680504e54fd4587eddcf2f37a2617ac2fbd2993f7bdf45442ace7d22
    1
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.1.3.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
@@ -175,11 +156,9 @@ ProofRandomScalar = 222a5e897cf59db8145db8d16e597e8facb80ae7d4e26d98
    Output = 7c6557b276a137922a0bcfc2aa2b35dd78322bd500235eb6d6b6f91bc5b
    56a52de2d65612d503236b321f5d0bebcbc52b64b92e426f29c9b8b69f52de98ae50
    7
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.1.3.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec4c1f
@@ -199,23 +178,19 @@ Output = ca688351e88afb1d841fde4401c79efebb2eb75e7998fa9737bd5a82a15
    2406d38bd29f680504e54fd4587eddcf2f37a2617ac2fbd2993f7bdf45442ace7d22
    1,7c6557b276a137922a0bcfc2aa2b35dd78322bd500235eb6d6b6f91bc5b56a52de
    2d65612d503236b321f5d0bebcbc52b64b92e426f29c9b8b69f52de98ae507
-~~~
 
-## decaf448-SHAKE256
+A.2.  decaf448-SHAKE256
 
-### OPRF Mode
+A.2.1.  OPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
    skSm = e8b1375371fd11ebeb224f832dcc16d371b4188951c438f751425699ed29e
    cc80c6c13e558ccd67634fd82eac94aa8d1f0d7fee990695d1e
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.2.1.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
    3833a26e9388336361686ff1f83df55046504dfecad8549ba112
@@ -226,11 +201,9 @@ EvaluationElement = 50ce4e60eed006e22e7027454b5a4b8319eb2bc8ced609eb
    Output = 37d3f7922d9388a15b561de5829bbf654c4089ede89c0ce0f3f85bcdba0
    9e382ce0ab3507e021f9e79706a1798ffeac68ebd5cf62e5eb9838c7068351d97ae3
    7
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.2.1.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
    3833a26e9388336361686ff1f83df55046504dfecad8549ba112
@@ -241,11 +214,9 @@ EvaluationElement = 162e9fa6e9d527c3cd734a31bf122a34dbd5bcb7bb23651f
    Output = a2a652290055cb0f6f8637a249ee45e32ef4667db0b4c80c0a70d2a6416
    4d01525cfdad5d870a694ec77972b9b6ec5d2596a5223e5336913f945101f0137f55
    e
-~~~
 
-### VOPRF Mode
+A.2.2.  VOPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -253,11 +224,9 @@ skSm = e3c01519a076a326a0eb566343e9b21c115fa18e6e85577ddbe890b33104f
    cc2835ddfb14a928dc3f5d79b936e17c76b99e0bf6a1680930e
    pkSm = 945fc518c47695cf65217ace04b86ac5e4cbe26ca649d52854bb16c494ce0
    9069d6add96b20d4b0ae311a87c9a73e3a146b525763ab2f955
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.2.2.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
    3833a26e9388336361686ff1f83df55046504dfecad8549ba112
@@ -274,11 +243,9 @@ ProofRandomScalar = b1b748135d405ce48c6973401d9455bb8ccd18b01d0295c0
    Output = e2ac40b634f36cccd8262b285adff7c9dcc19cd308564a5f4e581d1a853
    5773b86fa4fc9f2203c370763695c5093aea4a7aedec4488b1340ba3bf663a23098c
    1
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.2.2.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
    3833a26e9388336361686ff1f83df55046504dfecad8549ba112
@@ -295,11 +262,9 @@ ProofRandomScalar = b1b748135d405ce48c6973401d9455bb8ccd18b01d0295c0
    Output = 862952380e07ec840d9f6e6f909c5a25d16c3dacb586d89a181b4aa7380
    c959baa8c480fe8e6c64e089d68ea7aeeb5817bd524d7577905b5bab487690048c94
    1
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.2.2.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
    3833a26e9388336361686ff1f83df55046504dfecad8549ba112,b1b748135d405ce
@@ -323,11 +288,9 @@ Output = e2ac40b634f36cccd8262b285adff7c9dcc19cd308564a5f4e581d1a853
    5773b86fa4fc9f2203c370763695c5093aea4a7aedec4488b1340ba3bf663a23098c
    1,862952380e07ec840d9f6e6f909c5a25d16c3dacb586d89a181b4aa7380c959baa
    8c480fe8e6c64e089d68ea7aeeb5817bd524d7577905b5bab487690048c941
-~~~
 
-### POPRF Mode
+A.2.3.  POPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -335,11 +298,9 @@ skSm = 792a10dcbd3ba4a52a054f6f39186623208695301e7adb9634b74709ab22d
    e402990eb143fd7c67ac66be75e0609705ecea800992aac8e19
    pkSm = 6c9d12723a5bbcf305522cc04b4a34d9ced2e12831826018ea7b5dcf54526
    47ad262113059bf0f6e4354319951b9d513c74f29cb0eec38c1
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.2.3.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Info = 7465737420696e666f
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
@@ -357,11 +318,9 @@ ProofRandomScalar = b1b748135d405ce48c6973401d9455bb8ccd18b01d0295c0
    Output = 4423f6dcc1740688ea201de57d76824d59cd6b859e1f9884b7eebc49b0b
    971358cf9cb075df1536a8ea31bcf55c3e31c2ba9cfa8efe54448d17091daeb9924e
    d
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.2.3.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
@@ -379,11 +338,9 @@ ProofRandomScalar = b1b748135d405ce48c6973401d9455bb8ccd18b01d0295c0
    Output = 8691905500510843902c44bdd9730ab9dc3925aa58ff9dd42765a2baf63
    3126de0c3adb93bef5652f38e5827b6396e87643960163a560fc4ac9738c8de4e4a8
    d
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.2.3.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 64d37aed22a27f5191de1c1d69fadb899d8862b58eb4220029e036ec65fa
@@ -408,23 +365,19 @@ Output = 4423f6dcc1740688ea201de57d76824d59cd6b859e1f9884b7eebc49b0b
    971358cf9cb075df1536a8ea31bcf55c3e31c2ba9cfa8efe54448d17091daeb9924e
    d,8691905500510843902c44bdd9730ab9dc3925aa58ff9dd42765a2baf633126de0
    c3adb93bef5652f38e5827b6396e87643960163a560fc4ac9738c8de4e4a8d
-~~~
 
-## P256-SHA256
+A.3.  P256-SHA256
 
-### OPRF Mode
+A.3.1.  OPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
    skSm = 159749d750713afe245d2d39ccfaae8381c53ce92d098a9375ee70739c7ac
    0bf
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.3.1.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
    d364
@@ -434,11 +387,9 @@ EvaluationElement = 030de02ffec47a1fd53efcdd1c6faf5bdc270912b8749e78
    3c7ca75bb412958832
    Output = a0b34de5fa4c5b6da07e72af73cc507cceeb48981b97b7285fc375345fe
    495dd
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.3.1.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
    d364
@@ -448,11 +399,9 @@ EvaluationElement = 03a0395fe3828f2476ffcd1f4fe540e5a8489322d398be3c
    4e5a869db7fcb7c52c
    Output = c748ca6dd327f0ce85f4ae3a8cd6d4d5390bbb804c9e12dcf94f853fece
    3dcce
-~~~
 
-### VOPRF Mode
+A.3.2.  VOPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -460,11 +409,9 @@ skSm = ca5d94c8807817669a51b196c34c1b7f8442fde4334a7121ae4736364312f
    ca6
    pkSm = 03e17e70604bcabe198882c0a1f27a92441e774224ed9c702e51dd17038b1
    02462
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.3.2.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
    d364
@@ -478,11 +425,9 @@ ProofRandomScalar = f9db001266677f62c095021db018cd8cbb55941d4073698c
    e45c405d1348b7b1
    Output = 0412e8f78b02c415ab3a288e228978376f99927767ff37c5718d420010a
    645a1
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.3.2.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
    d364
@@ -496,11 +441,9 @@ ProofRandomScalar = f9db001266677f62c095021db018cd8cbb55941d4073698c
    e45c405d1348b7b1
    Output = 771e10dcd6bcd3664e23b8f2a710cfaaa8357747c4a8cbba03133967b5c
    24f18
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.3.2.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
    d364,f9db001266677f62c095021db018cd8cbb55941d4073698ce45c405d1348b7b
@@ -518,11 +461,9 @@ ProofRandomScalar = 350e8040f828bf6ceca27405420cdf3d63cb3aef005f40ba
    Output = 0412e8f78b02c415ab3a288e228978376f99927767ff37c5718d420010a
    645a1,771e10dcd6bcd3664e23b8f2a710cfaaa8357747c4a8cbba03133967b5c24f
    18
-~~~
 
-### POPRF Mode
+A.3.3.  POPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -530,11 +471,9 @@ skSm = 6ad2173efa689ef2c27772566ad7ff6e2d59b3b196f00219451fb2c89ee4d
    ae2
    pkSm = 030d7ff077fddeec965db14b794f0cc1ba9019b04a2f4fcc1fa525dedf72e
    2a3e3
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.3.3.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Info = 7465737420696e666f
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -549,11 +488,9 @@ ProofRandomScalar = f9db001266677f62c095021db018cd8cbb55941d4073698c
    e45c405d1348b7b1
    Output = 193a92520bd8fd1f37accb918040a57108daa110dc4f659abe212636d24
    5c592
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.3.3.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -568,11 +505,9 @@ ProofRandomScalar = f9db001266677f62c095021db018cd8cbb55941d4073698c
    e45c405d1348b7b1
    Output = 1e6d164cfd835d88a31401623549bf6b9b306628ef03a7962921d62bc5f
    fce8c
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.3.3.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 3338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -591,23 +526,19 @@ ProofRandomScalar = 350e8040f828bf6ceca27405420cdf3d63cb3aef005f40ba
    Output = 193a92520bd8fd1f37accb918040a57108daa110dc4f659abe212636d24
    5c592,1e6d164cfd835d88a31401623549bf6b9b306628ef03a7962921d62bc5ffce
    8c
-~~~
 
-## P384-SHA384
+A.4.  P384-SHA384
 
-### OPRF Mode
+A.4.1.  OPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
    skSm = dfe7ddc41a4646901184f2b432616c8ba6d452f9bcd0c4f75a5150ef2b2ed
    02ef40b8b92f60ae591bcabd72a6518f188
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.4.1.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
    889d89dbfa691d1cde91517fa222ed7ad364
@@ -617,11 +548,9 @@ EvaluationElement = 03af2a4fc94770d7a7bf3187ca9cc4faf3732049eded2442
    ee50fbddda58b70ae2999366f72498cdbc43e6f2fc184afe30
    Output = ed84ad3f31a552f0456e58935fcc0a3039db42e7f356dcb32aa6d487b6b
    815a07d5813641fb1398c03ddab5763874357
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.4.1.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
    889d89dbfa691d1cde91517fa222ed7ad364
@@ -631,11 +560,9 @@ EvaluationElement = 034e9b9a2960b536f2ef47d8608b21597ba400d5abfa1825
    fd21c36b75f927f396bf3716c96129d1fa4a77fa1d479c8d7b
    Output = dd4f29da869ab9355d60617b60da0991e22aaab243a3460601e48b07585
    9d1c526d36597326f1b985778f781a1682e75
-~~~
 
-### VOPRF Mode
+A.4.2.  VOPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -643,11 +570,9 @@ skSm = 051646b9e6e7a71ae27c1e1d0b87b4381db6d3595eeeb1adb41579adbf992
    f4278f9016eafc944edaa2b43183581779d
    pkSm = 031d689686c611991b55f1a1d8f4305ccd6cb719446f660a30db61b7aa87b
    46acf59b7c0d4a9077b3da21c25dd482229a0
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.4.2.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
    889d89dbfa691d1cde91517fa222ed7ad364
@@ -662,11 +587,9 @@ ProofRandomScalar = 803d955f0e073a04aa5d92b3fb739f56f9db001266677f62
    c095021db018cd8cbb55941d4073698ce45c405d1348b7b1
    Output = 3333230886b562ffb8329a8be08fea8025755372817ec969d114d1203d0
    26b4a622beab60220bf19078bca35a529b35c
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.4.2.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
    889d89dbfa691d1cde91517fa222ed7ad364
@@ -681,11 +604,9 @@ ProofRandomScalar = 803d955f0e073a04aa5d92b3fb739f56f9db001266677f62
    c095021db018cd8cbb55941d4073698ce45c405d1348b7b1
    Output = b91c70ea3d4d62ba922eb8a7d03809a441e1c3c7af915cbc2226f485213
    e895942cd0f8580e6d99f82221e66c40d274f
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.4.2.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
    889d89dbfa691d1cde91517fa222ed7ad364,803d955f0e073a04aa5d92b3fb739f5
@@ -706,11 +627,9 @@ eca27405420cdf3d63cb3aef005f40ba51943c8026877963
    Output = 3333230886b562ffb8329a8be08fea8025755372817ec969d114d1203d0
    26b4a622beab60220bf19078bca35a529b35c,b91c70ea3d4d62ba922eb8a7d03809
    a441e1c3c7af915cbc2226f485213e895942cd0f8580e6d99f82221e66c40d274f
-~~~
 
-### POPRF Mode
+A.4.3.  POPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -718,11 +637,9 @@ skSm = 5b2690d6954b8fbb159f19935d64133f12770c00b68422559c65431942d72
    1ff79d47d7a75906c30b7818ec0f38b7fb2
    pkSm = 02f00f0f1de81e5d6cf18140d4926ffdc9b1898c48dc49657ae36eb1e45de
    b8b951aaf1f10c82d2eaa6d02aafa3f10d2b6
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.4.3.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Info = 7465737420696e666f
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
@@ -738,11 +655,9 @@ ProofRandomScalar = 803d955f0e073a04aa5d92b3fb739f56f9db001266677f62
    c095021db018cd8cbb55941d4073698ce45c405d1348b7b1
    Output = 0188653cfec38119a6c7dd7948b0f0720460b4310e40824e048bf82a165
    27303ed449a08caf84272c3bbc972ede797df
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.4.3.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
@@ -758,11 +673,9 @@ ProofRandomScalar = 803d955f0e073a04aa5d92b3fb739f56f9db001266677f62
    c095021db018cd8cbb55941d4073698ce45c405d1348b7b1
    Output = ff2a527a21cc43b251a567382677f078c6e356336aec069dea8ba369953
    43ca3b33bb5d6cf15be4d31a7e6d75b30d3f5
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.4.3.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 504650f53df8f16f6861633388936ea23338fa65ec36e0290022b48eb562
@@ -784,24 +697,20 @@ eca27405420cdf3d63cb3aef005f40ba51943c8026877963
    Output = 0188653cfec38119a6c7dd7948b0f0720460b4310e40824e048bf82a165
    27303ed449a08caf84272c3bbc972ede797df,ff2a527a21cc43b251a567382677f0
    78c6e356336aec069dea8ba36995343ca3b33bb5d6cf15be4d31a7e6d75b30d3f5
-~~~
 
-## P521-SHA512
+A.5.  P521-SHA512
 
-### OPRF Mode
+A.5.1.  OPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
    skSm = 0153441b8faedb0340439036d6aed06d1217b34c42f17f8db4c5cc610a4a9
    55d698a688831b16d0dc7713a1aa3611ec60703bffc7dc9c84e3ed673b3dbe1d5fcc
    ea6
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.5.1.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
    88936ea23338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -815,11 +724,9 @@ EvaluationElement = 030166371cf827cb2fb9b581f97907121a16e2dc5d8b10ce
    Output = 26232de6fff83f812adadadb6cc05d7bbeee5dca043dbb16b03488abb99
    81d0a1ef4351fad52dbd7e759649af393348f7b9717566c19a6b8856284d69375c80
    9
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.5.1.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
    88936ea23338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -833,11 +740,9 @@ af5640cbb2d9620a6e
    Output = ad1f76ef939042175e007738906ac0336bbd1d51e287ebaa66901abdd32
    4ea3ffa40bfc5a68e7939c2845e0fd37a5a6e76dadb9907c6cc8579629757fd4d04b
    a
-~~~
 
-### VOPRF Mode
+A.5.2.  VOPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -847,11 +752,9 @@ skSm = 015c7fc1b4a0b1390925bae915bd9f3d72009d44d9241b962428aad5d13f2
    pkSm = 0301505d646f6e4c9102451eb39730c4ba1c4087618641edbdba4a60896b0
    7fd0c9414ce553cbf25b81dfcca50a8f6724ab7a2bc4d0cf736967a287bb6084cc06
    78ac0
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.5.2.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
    88936ea23338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -872,11 +775,9 @@ e45c405d1348b7b1
    Output = 5e003d9b2fb540b3d4bab5fedd154912246da1ee5e557afd8f56415faa1
    a0fadff6517da802ee254437e4f60907b4cda146e7ba19e249eef7be405549f62954
    b
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.5.2.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
    88936ea23338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -897,11 +798,9 @@ e45c405d1348b7b1
    Output = fa15eebba81ecf40954f7135cb76f69ef22c6bae394d1a4362f9b03066b
    54b6604d39f2e53369ca6762a3d9787e230e832aa85955af40ecb8deebb009a8cf47
    4
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.5.2.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
    88936ea23338fa65ec36e0290022b48eb562889d89dbfa691d1cde91517fa222ed7a
@@ -929,11 +828,9 @@ Output = 5e003d9b2fb540b3d4bab5fedd154912246da1ee5e557afd8f56415faa1
    a0fadff6517da802ee254437e4f60907b4cda146e7ba19e249eef7be405549f62954
    b,fa15eebba81ecf40954f7135cb76f69ef22c6bae394d1a4362f9b03066b54b6604
    d39f2e53369ca6762a3d9787e230e832aa85955af40ecb8deebb009a8cf474
-~~~
 
-### POPRF Mode
+A.5.3.  POPRF Mode
 
-~~~
    Seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a
    3a3
    KeyInfo = 74657374206b6579
@@ -943,11 +840,9 @@ b27
    pkSm = 0301de8ceb9ffe9237b1bba87c320ea0bebcfc3447fe6f278065c6c69886d
    692d1126b79b6844f829940ace9b52a5e26882cf7cbc9e57503d4cca3cd834584729
    f812a
-~~~
 
-#### Test Vector 1, Batch Size 1
+A.5.3.1.  Test Vector 1, Batch Size 1
 
-~~~
    Input = 00
    Info = 7465737420696e666f
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
@@ -969,11 +864,9 @@ e45c405d1348b7b1
    Output = 808ae5b87662eaaf0b39151dd85991b94c96ef214cb14a68bf5c1439548
    82d330da8953a80eea20788e552bc8bbbfff3100e89f9d6e341197b122c46a208733
    b
-~~~
 
-#### Test Vector 2, Batch Size 1
+A.5.3.2.  Test Vector 2, Batch Size 1
 
-~~~
    Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
@@ -995,11 +888,9 @@ e45c405d1348b7b1
    Output = 27032e24b1a52a82ab7f4646f3c5df0f070f499db98b9c5df33972bd5af
    5762c3638afae7912a6c1acdb1ae2ab2fa670bd5486c645a0e55412e08d33a4a0d6e
    3
-~~~
 
-#### Test Vector 3, Batch Size 2
+A.5.3.3.  Test Vector 3, Batch Size 2
 
-~~~
    Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a
    Info = 7465737420696e666f
    Blind = 00d1dccf7a51bafaf75d4a866d53d8cafe4d504650f53df8f16f68616333
@@ -1028,5 +919,4 @@ Output = 808ae5b87662eaaf0b39151dd85991b94c96ef214cb14a68bf5c1439548
    82d330da8953a80eea20788e552bc8bbbfff3100e89f9d6e341197b122c46a208733
    b,27032e24b1a52a82ab7f4646f3c5df0f070f499db98b9c5df33972bd5af5762c36
    38afae7912a6c1acdb1ae2ab2fa670bd5486c645a0e55412e08d33a4a0d6e3
-~~~
 "#;

src/tests/parser.rs

@@ -15,7 +15,7 @@ pub(crate) fn rfc_to_json(input: &str) -> String {
 }
 
 fn parse_ciphersuites(input: &str) -> String {
-    let re = regex::Regex::new(r"\n## (?P<ciphersuite>.+?)\n").unwrap();
+    let re = regex::Regex::new(r"\nA\.\d\.  (?P<ciphersuite>.+?)\n\n").unwrap();
     let mut ciphersuites = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();
@@ -34,7 +34,7 @@ fn parse_ciphersuites(input: &str) -> String {
 }
 
 fn parse_modes(input: &str) -> String {
-    let re = regex::Regex::new(r"### (?P<mode>.*+) Mode").unwrap();
+    let re = regex::Regex::new(r"A\.\d.\d\.  (?P<mode>.*?) Mode").unwrap();
     let mut modes = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();
@@ -53,7 +53,7 @@ fn parse_modes(input: &str) -> String {
 }
 
 fn parse_vectors(input: &str) -> String {
-    let re = regex::Regex::new(r"Test Vector.*+\n").unwrap();
+    let re = regex::Regex::new(r"A\.\d.\d\.\d\.  Test Vector.*+\n").unwrap();
     let mut vectors = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();

src/tests/test_cfrg_vectors.rs

@@ -89,6 +89,7 @@ macro_rules! json_to_test_vectors {
 fn test_vectors() -> Result<()> {
     use p256::NistP256;
     use p384::NistP384;
+    use p521::NistP521;
 
     let rfc: Value = serde_json::from_str(rfc_to_json(super::cfrg_vectors::VECTORS).as_str())
         .expect("Could not parse json");
@@ -188,6 +189,33 @@ fn test_vectors() -> Result<()> {
     test_poprf_finalize::<NistP384>(&p384_poprf_tvs)?;
     test_poprf_evaluate::<NistP384>(&p384_poprf_tvs)?;
 
+    let p521_oprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P521-SHA512"), String::from("OPRF"));
+    assert_ne!(p521_oprf_tvs.len(), 0);
+    test_oprf_seed_to_key::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_blind::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_blind_evaluate::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_finalize::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_evaluate::<NistP521>(&p521_oprf_tvs)?;
+
+    let p521_voprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P521-SHA512"), String::from("VOPRF"));
+    assert_ne!(p521_voprf_tvs.len(), 0);
+    test_voprf_seed_to_key::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_blind::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_blind_evaluate::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_finalize::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_evaluate::<NistP521>(&p521_voprf_tvs)?;
+
+    let p521_poprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P521-SHA512"), String::from("POPRF"));
+    assert_ne!(p521_poprf_tvs.len(), 0);
+    test_poprf_seed_to_key::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_blind::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_blind_evaluate::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_finalize::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_evaluate::<NistP521>(&p521_poprf_tvs)?;
+
     Ok(())
 }
 

src/voprf.rs

@@ -537,7 +537,7 @@ where
     )?;
 
     Ok(blinds
-        .zip(messages.into_iter())
+        .zip(messages)
         .map(|(blind, x)| x.0 * &CS::Group::invert_scalar(blind)))
 }
 
@@ -836,6 +836,7 @@ mod tests {
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
         use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -869,6 +870,15 @@ mod tests {
         zeroize_voprf_client::<NistP384>();
         zeroize_voprf_server::<NistP384>();
 
+        verifiable_retrieval::<NistP521>();
+        verifiable_batch_retrieval::<NistP521>();
+        verifiable_bad_public_key::<NistP521>();
+        verifiable_batch_bad_public_key::<NistP521>();
+        verifiable_server_evaluate::<NistP521>();
+
+        zeroize_voprf_client::<NistP521>();
+        zeroize_voprf_server::<NistP521>();
+
         Ok(())
     }
 }