Specify a check on the order of pi_B in a zk-proof.

Signed-off-by: Daira Hopwood <daira@jacaranda.org>

Author: daira

protocol/protocol.tex

@@ -2719,7 +2719,9 @@
   \item the lead byte is of the required form;
   \item the remaining bytes encode a big-endian representation of an integer
         in $\range{0}{q\!-\!1}$ or (in the case of $\Proof_B$) $\range{0}{q^2\!-\!1}$;
-  \item the encoding represents a point on the relevant curve.
+  \item the encoding represents a point on the relevant curve;
+  \item in the case of $\Proof_B$, that the point is of order $r$ (and hence in
+        the subgroup $\GroupG{2}$).
 \end{itemize}
 
 \nsubsection{\JoinSplitParameters} \label{jsparameters}
@@ -3679,6 +3681,12 @@
 
 \nsection{Change history}
 
+\subparagraph{2016.0-beta-1.11}
+
+\begin{itemize}
+    \item Specify a check on the order of $\Proof_B$ in a \zeroKnowledgeProof.
+\end{itemize}
+
 \subparagraph{2016.0-beta-1.10}
 
 \begin{itemize}