Thomas' nits

[chris-wood]

• In section 4 (page 12): "all arithmetic, comparisons, and assignments MUST..." -> I think it lacks a word after "arithmetic". Maybe "all arithmetic operations"?
• In section I.3, the renaming "SHAKE-128" -> "SHAKE128" has been applied, but the section still contains "hash = SHAKE_128" (I suppose that the underscore character evaded the search&replace).

Also, some pseudocode blocks have been moved left by three characters (i.e. the three-space margin was removed). This is not systematic; e.g. sgn0() was moved left (section 4.1), but not sgn0_m_eq_1() (in the same section!). Pseudocode blocks that lost their margin are:

• sgn0() (4.1)
• sgn0_m_eq_2() (4.1)
• map_to_curve_svdw() (D.1)
• map_to_curve_simple_swu() (D.2)
• map_to_curve_elligator2() (D.3)
• map_to_curve_simple_swu_3mod4() (E.2.1)
• map_to_curve_elligator2_curve25519() (E.3.1)
• map_to_curve_elligator2_edwards25519() (E.3.2)
• map_to_curve_elligator2_3mod4() (E.3.5)
• map_to_curve_elligator2_5mod8() (E.3.6) Additionally, the map_to_curve_elligator2_curve448() pseudocode (E.3.3) has a reduced margin with a single space instead of three.

[chris-wood]

@kwantam after we land these, we can spin a new version for RGLC (per instruction from the chairs). Do we also want to land the ristretto255 change, too?

[kwantam]

@chris-wood yes, let's land both.

Some responses:

• "all arithmetic" seems fine to me---it's a noun in this context.
• oh sorry, must have missed the SHAKE_128 last time around
• agreed that we should make the margins consistent where possible.