Upstream: editorial defects in the crypto draft

[OR13]

Collected while reading PR #39 against crypto::exp_ihat. None of these is a design question — they are the kind of thing an implementer trips over and a careful editorial pass removes. Filed here so they travel together if we report upstream.

Typos and naming inconsistencies

Where	Problem
EndorsementPresentation	e Sclar — should be Scalar
EndorsementPresentation	field typed OneofNProof, but the struct is declared OneOfNProof — inconsistent capitalisation, and neither is defined with the other's spelling
"Putting it together"	refers to "Verifying a Partial Presentation"; the actual section is "Verifying a partial endorsement"
before # Issuance	no blank line separating it from the preceding paragraph, so kramdown will not render it as a heading

Substantive typing errors, tracked separately

• m Scalar in EndorsementPresentation — see exp-ihat: m is typed as a Scalar, which cannot carry endorsement_context #7. m is the input to Y = Hash2Curve(m), which per RFC 9380 consumes octets, not a field element; and a 32-byte scalar cannot carry the endorsement_context that protocols §4.1.3 requires verification to expose.
• The {{ARCH}} P-256 forward reference — see Upstream: the two MoLE drafts disagree on point compression #1. The architecture draft contains no group instantiation, so the crypto draft's only statement about which group to use points at content that does not exist.

Structural observations

• struct { p Point<0..2^16-1> } OneOfNParams and struct { s Scalar<0..2^16-1> } OneOfNOpening wrap a single vector field in a struct. Harmless, but inconsistent with how the other structs in the document are written, and the field names p and s are terse for normative text.
• OneOfNProof.third is byte<0..2^8-1> while challenge is byte<0..2^16-1>; both should probably be opaque per TLS presentation-language convention, which the document's Conventions section claims to follow.
• The Security Considerations section added by PR #39 is two sentences and covers only single-show unlinkability and the PQ public-key caveat. Upstream: Anchor nonce reuse recovers the secret key #9 (Anchor nonce reuse recovering the secret key) has no home yet but now has an obvious one.

Datapoint

PR #39 replaces the John Doe / ACME placeholder author with Watson Ladd (Akamai). So the crypto draft now has a named author distinct from the Schlesinger/Jackson/Meunier trio on the other three drafts — useful to know when deciding where to raise any of this.