1 files changed, 6 insertions, 9 deletions

diff --git a/draft-schanzen-gns.xml b/draft-schanzen-gns.xml
index 10c95d0..0141940 100644
--- a/draft-schanzen-gns.xml
+++ b/draft-schanzen-gns.xml
@@ -665,10 +665,10 @@ NONCE := HKDF-Expand (PRK_n, label, 32 / 8)
 zk := a * G
 PRK_h := HKDF-Extract ("key-derivation", zk)
 h := HKDF-Expand (PRK_h, label | "gns", 512 / 8)
-a' := h * a mod L
-a'[0] &= 248;
-a'[31] &= 127;
-a'[31] |= 64;
+h[31] &= 7
+a1 := a / 8 /* 8 is the cofactor of Curve25519 */
+a2 := h * a1 mod L
+a' = a2 * 8 /* 8 is the cofactor of Curve25519 */
            ]]></artwork>
          <t>
            Equally, given a label, the output of the HDKD-Public function is
@@ -677,11 +677,8 @@ a'[31] |= 64;
          <artwork name="" type="" align="left" alt=""><![CDATA[
 PRK_h := HKDF-Extract ("key-derivation", zk)
 h := HKDF-Expand (PRK_h, label | "gns", 512 / 8)
-a' = h mod L
-a'[0] &= 248;
-a'[31] &= 127;
-a'[31] |= 64;
-zk' := a' * zk
+h[31] &= 7  // Implies h mod L == h
+zk’ := h * zk
          ]]></artwork>
          <t>
            The EDKEY cryptosystem uses a