Notation
In this section we introduce some generic notation used throughout the spec. The primitive-specific notation is introduced in the respective sections.
We denote by the finite abelian group based on an elliptic curve over a finite prime-order field (note that we simplify the notation and drop the explicit dependency on and security parameter ). Most importantly, we assume the order of the group to be of the form for some small cofactor (sometimes equal to 1) and large prime number , and that the (hence) unique (sub)group of order is generated by a known base point , i.e., , in which the computational Diffie-Hellman (CDH) problem is believed to be hard. We use to denote a cryptographically safe hash function, modeled as a random oracle, for any value of (we tried using but the katex compiler was not happy with it).
An elliptic curve point can be determined using the y-coordinate and the sign of the -coordinate, meaning that an elliptic curve point can be represented using bits. All elements in or are serialised in little-endian form. Elliptic curve points are encoded using their -coordinate followed by the sign bit of the coordinate. An element in is negative if the enconding of is lexicographically larger than the encoding of