In section 4 (page 12): "all arithmetic, comparisons, and assignments MUST..." -> I think it lacks a word after "arithmetic". Maybe "all arithmetic operations"?
In section I.3, the renaming "SHAKE-128" -> "SHAKE128" has been applied, but the section still contains "hash = SHAKE_128" (I suppose that the underscore character evaded the search&replace).
Also, some pseudocode blocks have been moved left by three characters (i.e. the three-space margin was removed). This is not systematic; e.g. sgn0() was moved left (section 4.1), but not sgn0_m_eq_1() (in the same section!). Pseudocode blocks that lost their margin are:
sgn0() (4.1)
sgn0_m_eq_2() (4.1)
map_to_curve_svdw() (D.1)
map_to_curve_simple_swu() (D.2)
map_to_curve_elligator2() (D.3)
map_to_curve_simple_swu_3mod4() (E.2.1)
map_to_curve_elligator2_curve25519() (E.3.1)
map_to_curve_elligator2_edwards25519() (E.3.2)
map_to_curve_elligator2_3mod4() (E.3.5)
map_to_curve_elligator2_5mod8() (E.3.6)
Additionally, the map_to_curve_elligator2_curve448() pseudocode (E.3.3) has a reduced margin with a single space instead of three.
@kwantam after we land these, we can spin a new version for RGLC (per instruction from the chairs). Do we also want to land the ristretto255 change, too?
Also, some pseudocode blocks have been moved left by three characters (i.e. the three-space margin was removed). This is not systematic; e.g. sgn0() was moved left (section 4.1), but not sgn0_m_eq_1() (in the same section!). Pseudocode blocks that lost their margin are: