- SK
- The secret key for the signature scheme.
- PK
- The public key for the signature scheme.
- L
- The total number of signed messages.
- R
- The number of message indexes that are disclosed (revealed) in a proof-of-knowledge of a signature.
- U
- The number of message indexes that are undisclosed in a proof-of-knowledge of a signature.
- scalar
- An integer between 0 and r-1, where r is the prime order of the selected groups, defined by each ciphersuite (see also
Notation ). - generator
- A valid point on the selected subgroup of the curve being used that is employed to commit a value.
- signature
- The digital signature output.
- presentation_header (ph)
- A payload generated and bound to the context of a specific spk.
- INVALID, ABORT
- Error indicators. INVALID refers to an error encountered during the Deserialization or Procedure steps of an operation. An INVALID value can be returned by a subroutine and handled by the calling operation. ABORT indicates that one or more of the initial constraints defined by the operation are not met. In that case, the operation will stop execution. An operation calling a subroutine that aborted must also immediately abort.

- a || b
- Denotes the concatenation of octet strings a and b.
- I \ J
- For sets I and J, denotes the difference of the two sets i.e., all the elements of I that do not appear in J, in the same order as they were in I.
- X[a..b]
- Denotes a slice of the array
`X`containing all elements from and including the value at index`a`until and including the value at index`b`. Note when this syntax is applied to an octet string, each element in the array`X`is assumed to be a single byte. - range(a, b)
- For integers a and b, with a <= b, denotes the ascending ordered list of all integers between a and b inclusive (i.e., the integers "i" such that a <= i <= b).
- length(input)
- Takes as input either an array or an octet string. If the input is an array, returns the number of elements of the array. If the input is an octet string, returns the number of bytes of the inputted octet string.

- E1, E2
- elliptic curve groups defined over finite fields. This document assumes that E1 has a more compact representation than E2, i.e., because E1 is defined over a smaller field than E2. For a pairing-friendly curve, this document denotes operations in E1 and E2 in additive notation, i.e., P + Q denotes point addition and x * P denotes scalar multiplication.
- G1, G2
- subgroups of E1 and E2 (respectively) having prime order r.
- GT
- a subgroup, of prime order r, of the multiplicative group of a field extension.
- e
- G1 x G2 -> GT: a non-degenerate bilinear map.
- r
- The prime order of the G1 and G2 subgroups.
- BP1, BP2
- base (constant) points on the G1 and G2 subgroups respectively.
- Identity_G1, Identity_G2, Identity_GT
- The identity element for the G1, G2, and GT subgroups respectively.
- hash_to_curve_g1(ostr, dst) -> P
- A cryptographic hash function that takes an arbitrary octet string as input and returns a point in G1, using the hash_to_curve operation defined in
and the inputted dst as the domain separation tag for that operation (more specifically, the inputted dst will become the DST parameter for the hash_to_field operation, called by hash_to_curve). - point_to_octets_g1(P) -> ostr, point_to_octets_g2(P) -> ostr
- returns the canonical representation of the point P for the respective subgroup as an octet string. This operation is also known as serialization.
- octets_to_point_g1(ostr) -> P, octets_to_point_g2(ostr) -> P
- returns the point P for the respective subgroup corresponding to the canonical representation ostr, or INVALID if ostr is not a valid output of the respective point_to_octets_g* function. This operation is also known as deserialization.