Possible bug in ristretto example

[jrg1k]

The ristretto example has the following snippet:

// -------- Second party -------- Send g^k and a^k
unsigned char k[crypto_core_ristretto255_SCALARBYTES];
randombytes_buf(k, sizeof k);

// Compute v = g^k
unsigned char v[crypto_core_ristretto255_BYTES];
crypto_scalarmult_ristretto255_base(v, k);

Here 32 bytes k are randomly generated and $v = g^k$ is computed.
In my testing this seems to result in an invalid point v if k is not in the interval 0..L.

If it is the case that crypto_scalarmult_ristretto255_base requires the scalar to be in the interval 0..L it should at the very least return an error if this is the case and the example should include a reduction step for k.

My current solution to solve this is to erase 4 bits from k: k[31] &= 0xf

[jedisct1]

Right, this should be crypto_core_ristretto255_scalar_random().

[jrg1k]

My current use case (custom hybrid signature scheme) derives key components from a seed. To keep this deterministic crypto_core_ristretto255_scalar_random is out of the question. May I ask if my current solution to erase the 4 most significant bits is sound?

[jedisct1]

In that case, use crypto_core_ristretto255_scalar_reduce().