Initialization

Choose a prime order group \(G_q\) of order \(q\) in which computing discrete logarithms is infeasible. Also choose four distinct generators \(g_0,g_1,G_0,G_1\) for it.

No party must know the discrete logarithm of any generator with respect to any other. Therefore those generators must be picked from \(G_q\) using a public procedure which follows the concept of nothing-up-my-sleeve, e.g. by appying a cryptographic hash function to sensible input values.

The chosen group and generators are public.

Example groups to choose from:

• Ristretto255, a group built upon curve25519.

• Multiplicative group of quadratic residues modulo safe prime \(p = 2q+1\)

• NIST P-256 (§ D.1.2.3). Should only be used if required by hardware constraints.