diff --git a/crypto/ec_extra/hash_to_curve.c b/crypto/ec_extra/hash_to_curve.c
index 04f37ad..6f8b599 100644
--- a/crypto/ec_extra/hash_to_curve.c
+++ b/crypto/ec_extra/hash_to_curve.c
@@ -28,21 +28,41 @@
 
 
 // This file implements hash-to-curve, as described in
-// draft-irtf-cfrg-hash-to-curve-06.
+// draft-irtf-cfrg-hash-to-curve-07.
+//
+// This hash-to-curve implementation is written generically with the
+// expectation that we will eventually wish to support other curves. If it
+// becomes a performance bottleneck, some possible optimizations by
+// specializing it to the curve:
+//
+// - Rather than using a generic |felem_exp|, specialize the exponentation to
+//   c2 with a faster addition chain.
+//
+// - |felem_mul| and |felem_sqr| are indirect calls to generic Montgomery
+//   code. Given the few curves, we could specialize
+//   |map_to_curve_simple_swu|. But doing this reasonably without duplicating
+//   code in C is difficult. (C++ templates would be useful here.)
+//
+// - P-521's Z and c2 have small power-of-two absolute values. We could save
+//   two multiplications in SSWU. (Other curves have reasonable values of Z
+//   and inconvenient c2.) This is unlikely to be worthwhile without C++
+//   templates to make specializing more convenient.
 
 // expand_message_xmd implements the operation described in section 5.3.1 of
-// draft-irtf-cfrg-hash-to-curve-06. It returns one on success and zero on
-// allocation failure or if |out_len| was too large.
+// draft-irtf-cfrg-hash-to-curve-07. It returns one on success and zero on
+// allocation failure or if |out_len| was too large. If |is_draft06| is one, it
+// implements the operation from draft-irtf-cfrg-hash-to-curve-06 instead.
 static int expand_message_xmd(const EVP_MD *md, uint8_t *out, size_t out_len,
                               const uint8_t *msg, size_t msg_len,
-                              const uint8_t *dst, size_t dst_len) {
+                              const uint8_t *dst, size_t dst_len,
+                              int is_draft06) {
   int ret = 0;
   const size_t block_size = EVP_MD_block_size(md);
   const size_t md_size = EVP_MD_size(md);
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init(&ctx);
 
-  // Long DSTs are hashed down to size.
+  // Long DSTs are hashed down to size. See section 5.3.3.
   OPENSSL_STATIC_ASSERT(EVP_MAX_MD_SIZE < 256, "hashed DST still too large");
   uint8_t dst_buf[EVP_MAX_MD_SIZE];
   if (dst_len >= 256) {
@@ -68,8 +88,9 @@
       !EVP_DigestUpdate(&ctx, kZeros, block_size) ||
       !EVP_DigestUpdate(&ctx, msg, msg_len) ||
       !EVP_DigestUpdate(&ctx, l_i_b_str_zero, sizeof(l_i_b_str_zero)) ||
-      !EVP_DigestUpdate(&ctx, &dst_len_u8, 1) ||
+      (is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
       !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+      (!is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
       !EVP_DigestFinal_ex(&ctx, b_0, NULL)) {
     goto err;
   }
@@ -93,8 +114,9 @@
     if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
         !EVP_DigestUpdate(&ctx, b_i, md_size) ||
         !EVP_DigestUpdate(&ctx, &i, 1) ||
-        !EVP_DigestUpdate(&ctx, &dst_len_u8, 1) ||
+        (is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
         !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+        (!is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
         !EVP_DigestFinal_ex(&ctx, b_i, NULL)) {
       goto err;
     }
@@ -115,7 +137,7 @@
 
 // num_bytes_to_derive determines the number of bytes to derive when hashing to
 // a number modulo |modulus|. See the hash_to_field operation defined in
-// section 5.2 of draft-irtf-cfrg-hash-to-curve-06.
+// section 5.2 of draft-irtf-cfrg-hash-to-curve-07.
 static int num_bytes_to_derive(size_t *out, const BIGNUM *modulus, unsigned k) {
   size_t bits = BN_num_bits(modulus);
   size_t L = (bits + k + 7) / 8;
@@ -148,16 +170,17 @@
 }
 
 // hash_to_field implements the operation described in section 5.2
-// of draft-irtf-cfrg-hash-to-curve-06, with count = 2. |k| is the security
+// of draft-irtf-cfrg-hash-to-curve-07, with count = 2. |k| is the security
 // factor.
 static int hash_to_field2(const EC_GROUP *group, const EVP_MD *md,
                           EC_FELEM *out1, EC_FELEM *out2, const uint8_t *dst,
                           size_t dst_len, unsigned k, const uint8_t *msg,
-                          size_t msg_len) {
+                          size_t msg_len, int is_draft06) {
   size_t L;
   uint8_t buf[4 * EC_MAX_BYTES];
   if (!num_bytes_to_derive(&L, &group->field, k) ||
-      !expand_message_xmd(md, buf, 2 * L, msg, msg_len, dst, dst_len)) {
+      !expand_message_xmd(md, buf, 2 * L, msg, msg_len, dst, dst_len,
+                          is_draft06)) {
     return 0;
   }
   BN_ULONG words[2 * EC_MAX_WORDS];
@@ -173,11 +196,12 @@
 // group order rather than a field element. |k| is the security factor.
 static int hash_to_scalar(const EC_GROUP *group, const EVP_MD *md,
                           EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
-                          unsigned k, const uint8_t *msg, size_t msg_len) {
+                          unsigned k, const uint8_t *msg, size_t msg_len,
+                          int is_draft06) {
   size_t L;
   uint8_t buf[EC_MAX_BYTES * 2];
   if (!num_bytes_to_derive(&L, &group->order, k) ||
-      !expand_message_xmd(md, buf, L, msg, msg_len, dst, dst_len)) {
+      !expand_message_xmd(md, buf, L, msg, msg_len, dst, dst_len, is_draft06)) {
     return 0;
   }
 
@@ -206,7 +230,7 @@
 }
 
 // sgn0_le implements the operation described in section 4.1.2 of
-// draft-irtf-cfrg-hash-to-curve-06.
+// draft-irtf-cfrg-hash-to-curve-07.
 static BN_ULONG sgn0_le(const EC_GROUP *group, const EC_FELEM *a) {
   uint8_t buf[EC_MAX_BYTES];
   size_t len;
@@ -215,8 +239,8 @@
 }
 
 // map_to_curve_simple_swu implements the operation described in section 6.6.2
-// of draft-irtf-cfrg-hash-to-curve-06, using the optimization in appendix D.2.
-// It returns one on success and zero on error.
+// of draft-irtf-cfrg-hash-to-curve-07, using the optimization in appendix
+// D.2.1. It returns one on success and zero on error.
 static int map_to_curve_simple_swu(const EC_GROUP *group, const EC_FELEM *Z,
                                    const BN_ULONG *c1, size_t num_c1,
                                    const EC_FELEM *c2, EC_RAW_POINT *out,
@@ -286,9 +310,10 @@
 static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
                          const EC_FELEM *Z, const EC_FELEM *c2, unsigned k,
                          EC_RAW_POINT *out, const uint8_t *dst, size_t dst_len,
-                         const uint8_t *msg, size_t msg_len) {
+                         const uint8_t *msg, size_t msg_len, int is_draft06) {
   EC_FELEM u0, u1;
-  if (!hash_to_field2(group, md, &u0, &u1, dst, dst_len, k, msg, msg_len)) {
+  if (!hash_to_field2(group, md, &u0, &u1, dst, dst_len, k, msg, msg_len,
+                      is_draft06)) {
     return 0;
   }
 
@@ -318,11 +343,10 @@
   return ec_felem_from_bytes(group, out, bytes, len);
 }
 
-int ec_hash_to_curve_p384_xmd_sha512_sswu(const EC_GROUP *group,
-                                          EC_RAW_POINT *out, const uint8_t *dst,
-                                          size_t dst_len, const uint8_t *msg,
-                                          size_t msg_len) {
-  // See section 8.3 of draft-irtf-cfrg-hash-to-curve-06.
+int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
+    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
+    size_t dst_len, const uint8_t *msg, size_t msg_len) {
+  // See section 8.3 of draft-irtf-cfrg-hash-to-curve-07.
   if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
@@ -352,48 +376,24 @@
   ec_felem_neg(group, &Z, &Z);
 
   return hash_to_curve(group, EVP_sha512(), &Z, &c2, /*k=*/192, out, dst,
-                       dst_len, msg, msg_len);
+                       dst_len, msg, msg_len, /*is_draft06=*/0);
 }
 
-int ec_hash_to_scalar_p384_xmd_sha512(const EC_GROUP *group, EC_SCALAR *out,
-                                      const uint8_t *dst, size_t dst_len,
-                                      const uint8_t *msg, size_t msg_len) {
+int ec_hash_to_scalar_p384_xmd_sha512_draft07(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len) {
   if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
   }
 
   return hash_to_scalar(group, EVP_sha512(), out, dst, dst_len, /*k=*/192, msg,
-                        msg_len);
+                        msg_len, /*is_draft06=*/0);
 }
 
-static int hash_to_curve_p521_xmd_sswu(const EC_GROUP *group, EC_RAW_POINT *out,
-                                       const uint8_t *dst, size_t dst_len,
-                                       const EVP_MD *md, unsigned k,
-                                       const uint8_t *msg, size_t msg_len) {
-  // This hash-to-curve implementation is written generically with the
-  // expectation that we will eventually wish to support P-256 or P-384. If it
-  // becomes a performance bottleneck, some possible optimizations by
-  // specializing it to the curve:
-  //
-  // - c1 = (p-3)/4 = 2^519-1. |felem_exp| costs 515S + 119M for this exponent.
-  //   A more efficient addition chain for c1 would cost 518S + 12M, but it
-  //   would require specializing the particular exponent.
-  //
-  // - P-521, while large, is a Mersenne prime, so we can likely do better than
-  //   the generic Montgomery implementation if we specialize the field
-  //   operations (below).
-  //
-  // - |felem_mul| and |felem_sqr| are indirect calls to generic Montgomery
-  //   code. Given the few curves, we could specialize
-  //   |map_to_curve_simple_swu|. But doing this reasonably without duplicating
-  //   code in C is difficult. (C++ templates would be useful here.)
-  //
-  // - P-521's Z and c2 have small power-of-two absolute values. We could save
-  //   two multiplications in SSWU. (Other curves have reasonable values of Z
-  //   and inconvenient c2.) This is unlikely to be worthwhile without C++
-  //   templates to make specializing more convenient.
-
+int ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
+    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
+    size_t dst_len, const uint8_t *msg, size_t msg_len) {
   // See section 8.3 of draft-irtf-cfrg-hash-to-curve-06.
   if (EC_GROUP_get_curve_name(group) != NID_secp521r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
@@ -408,38 +408,18 @@
   }
   ec_felem_neg(group, &Z, &Z);
 
-  return hash_to_curve(group, md, &Z, &c2, k, out, dst, dst_len, msg, msg_len);
+  return hash_to_curve(group, EVP_sha512(), &Z, &c2, /*k=*/256, out, dst,
+                       dst_len, msg, msg_len, /*is_draft06=*/1);
 }
 
-int ec_hash_to_curve_p521_xmd_sha512_sswu(const EC_GROUP *group,
-                                          EC_RAW_POINT *out, const uint8_t *dst,
-                                          size_t dst_len, const uint8_t *msg,
-                                          size_t msg_len) {
-  return hash_to_curve_p521_xmd_sswu(group, out, dst, dst_len, EVP_sha512(),
-                                     /*k=*/256, msg, msg_len);
-}
-
-int ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing(
-    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
-    size_t dst_len, const uint8_t *msg, size_t msg_len) {
-  // The specification defines the P-521 suites inconsistently. It specifies
-  // L = 96 for hash_to_field, but computing L from k as specified gives L = 98.
-  // See https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/issues/237.
-  //
-  // Setting k to 240 gives L = 96. We implement this variation to test with the
-  // original test vectors, which were computed with the smaller L.
-  return hash_to_curve_p521_xmd_sswu(group, out, dst, dst_len, EVP_sha512(),
-                                     /*k=*/240, msg, msg_len);
-}
-
-int ec_hash_to_scalar_p521_xmd_sha512(const EC_GROUP *group, EC_SCALAR *out,
-                                      const uint8_t *dst, size_t dst_len,
-                                      const uint8_t *msg, size_t msg_len) {
+int ec_hash_to_scalar_p521_xmd_sha512_draft06(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len) {
   if (EC_GROUP_get_curve_name(group) != NID_secp521r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
   }
 
   return hash_to_scalar(group, EVP_sha512(), out, dst, dst_len, /*k=*/256, msg,
-                        msg_len);
+                        msg_len, /*is_draft06=*/1);
 }
diff --git a/crypto/ec_extra/internal.h b/crypto/ec_extra/internal.h
index eea282c..940a414 100644
--- a/crypto/ec_extra/internal.h
+++ b/crypto/ec_extra/internal.h
@@ -27,48 +27,46 @@
 // Hash-to-curve.
 //
 // The following functions implement primitives from
-// draft-irtf-cfrg-hash-to-curve-06. We currently only implement the P-384 and
-// P-521 suites, but others can be added as needed. The |dst| parameter in each
-// function is the domain separation tag and must be unique for each protocol
-// and between the |hash_to_curve| and |hash_to_scalar| variants. See
-// section 3.1 of the spec for additional guidance on this parameter.
+// draft-irtf-cfrg-hash-to-curve. The |dst| parameter in each function is the
+// domain separation tag and must be unique for each protocol and between the
+// |hash_to_curve| and |hash_to_scalar| variants. See section 3.1 of the spec
+// for additional guidance on this parameter.
 
-// ec_hash_to_curve_p384_sha512_sswu hashes |msg| to a point on |group| and
-// writes the result to |out|, implementing the P384_XMD:SHA-512_SSWU_RO_ suite.
-// It returns one on success and zero on error.
-OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha512_sswu(
+// ec_hash_to_curve_p384_xmd_sha512_sswu_draft07 hashes |msg| to a point on
+// |group| and writes the result to |out|, implementing the
+// P384_XMD:SHA-512_SSWU_RO_ suite from draft-irtf-cfrg-hash-to-curve-07. It
+// returns one on success and zero on error.
+OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
     const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
     size_t dst_len, const uint8_t *msg, size_t msg_len);
 
-// ec_hash_to_scalar_p384_xmd_sha512 hashes |msg| to a scalar on |group| and
-// writes the result to |out|, using the hash_to_field operation from the
-// P384_XMD:SHA-512_SSWU_RO_ suite, but generating a value modulo the group
-// order rather than a field element.
-OPENSSL_EXPORT int ec_hash_to_scalar_p384_xmd_sha512(
+// ec_hash_to_scalar_p384_xmd_sha512_draft07 hashes |msg| to a scalar on |group|
+// and writes the result to |out|, using the hash_to_field operation from the
+// P384_XMD:SHA-512_SSWU_RO_ suite from draft-irtf-cfrg-hash-to-curve-07, but
+// generating a value modulo the group order rather than a field element.
+OPENSSL_EXPORT int ec_hash_to_scalar_p384_xmd_sha512_draft07(
     const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
     const uint8_t *msg, size_t msg_len);
 
-// ec_hash_to_curve_p521_sha512_sswu hashes |msg| to a point on |group| and
-// writes the result to |out|, implementing the P521_XMD:SHA-512_SSWU_RO_ suite.
-// It returns one on success and zero on error.
-OPENSSL_EXPORT int ec_hash_to_curve_p521_xmd_sha512_sswu(
-    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
-    size_t dst_len, const uint8_t *msg, size_t msg_len);
-
-// ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing behaves like
-// |ec_hash_to_curve_p521_sha512_sswu| but reproduces a spec issue reflected in
-// the original test vectors.
+// ec_hash_to_curve_p521_xmd_sha512_sswu_draft06 hashes |msg| to a point on
+// |group| and writes the result to |out|, implementing the
+// P521_XMD:SHA-512_SSWU_RO_ suite from draft-irtf-cfrg-hash-to-curve-06. It
+// returns one on success and zero on error.
 //
-// This function is exposed for test purposes and should not be used elsewhere.
-OPENSSL_EXPORT int ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing(
+// This function implements an older version of the draft and should not be used
+// in new code.
+OPENSSL_EXPORT int ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
     const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
     size_t dst_len, const uint8_t *msg, size_t msg_len);
 
-// ec_hash_to_scalar_p521_xmd_sha512 hashes |msg| to a scalar on |group| and
-// writes the result to |out|, using the hash_to_field operation from the
-// P521_XMD:SHA-512_SSWU_RO_ suite, but generating a value modulo the group
-// order rather than a field element.
-OPENSSL_EXPORT int ec_hash_to_scalar_p521_xmd_sha512(
+// ec_hash_to_scalar_p521_xmd_sha512_draft06 hashes |msg| to a scalar on |group|
+// and writes the result to |out|, using the hash_to_field operation from the
+// P521_XMD:SHA-512_SSWU_RO_ suite from draft-irtf-cfrg-hash-to-curve-06, but
+// generating a value modulo the group order rather than a field element.
+//
+// This function implements an older version of the draft and should not be used
+// in new code.
+OPENSSL_EXPORT int ec_hash_to_scalar_p521_xmd_sha512_draft06(
     const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
     const uint8_t *msg, size_t msg_len);
 
diff --git a/crypto/fipsmodule/ec/ec_test.cc b/crypto/fipsmodule/ec/ec_test.cc
index e08da93..59d55b5 100644
--- a/crypto/fipsmodule/ec/ec_test.cc
+++ b/crypto/fipsmodule/ec/ec_test.cc
@@ -1135,26 +1135,26 @@
     const char *y_hex;
   };
   static const HashToCurveTest kTests[] = {
-      // See draft-irtf-cfrg-hash-to-curve-06, appendix G.2.1.
-      {&ec_hash_to_curve_p384_xmd_sha512_sswu, NID_secp384r1,
+      // See draft-irtf-cfrg-hash-to-curve-07, appendix G.2.1.
+      {&ec_hash_to_curve_p384_xmd_sha512_sswu_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SSWU_RO_TESTGEN", "",
-       "619d4168877421106aecb16ec35d84b7fdfa215cdb446d82bac49f"
-       "6eab51a34b4d5314823f7639293cf6471c6c981a99",
-       "e5035c694665ca25b2c57542673af6b91288110b0b0689657cd031"
-       "96976d82dec104fd9f91296c85d1ed94bc9309840e"},
-      {&ec_hash_to_curve_p384_xmd_sha512_sswu, NID_secp384r1,
+       "2fc0b9efdd63a8e43b4db88dc12f03c798f6fd91bccac0c9096185"
+       "4386e58fdc54fc2a01f0f358759054ce1f9b762025",
+       "949b936fabb72cdb02cd7980b86cb6a3adf286658e81301648851d"
+       "b8a49d9bec00ccb57698d559fc5960fa5030a8e54b"},
+      {&ec_hash_to_curve_p384_xmd_sha512_sswu_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SSWU_RO_TESTGEN", "abc",
-       "d7c33555606b86c3ffaa1a645f806bac9d553a769f5a735d75a395"
-       "d58a70956b6d3bdbd6a6a8c83121678a036005208a",
-       "e1c55f372a905040576f61fbc07e9664359e76f3e7b5be8dfe7224"
-       "720f85753a823e94a3f886ced2ec5ce13b1248147a"},
-      {&ec_hash_to_curve_p384_xmd_sha512_sswu, NID_secp384r1,
+       "4f3338035391e8ce8ce40c974136f0edc97f392ffd44a643338741"
+       "8ed1b8c2603487e1688ec151f048fbc6b2c138c92f",
+       "152b90aef6558be328a3168855fb1906452e7167b0f7c8a56ff9d4"
+       "fa87d6fb522cdf8e409db54418b2c764fd26260757"},
+      {&ec_hash_to_curve_p384_xmd_sha512_sswu_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SSWU_RO_TESTGEN", "abcdef0123456789",
-       "d1f4bdd7ef9ee1c2d57ccd2b3b80123ccf3eb64b2f0a3ad26b8cd1"
-       "a8a8e411aadb9922d0e66a89ef0e78dba1489e23ea",
-       "9f376abd97ab8838c604a05ad17be1dfe0d924ddf0184341ec8e5a"
-       "ef9efb0f6559ab3048b4e1e0e42ac19ccb6d1dd892"},
-      {&ec_hash_to_curve_p384_xmd_sha512_sswu, NID_secp384r1,
+       "e9e5d7ac397e123d060ad44301cbc8eb972f6e64ebcff29dcc9b9a"
+       "10357902aace2240c580fec85e5b427d98b4e80703",
+       "916cb8963521ad75105be43cc4148e5a5bbb4fcf107f1577e4f7fa"
+       "3ca58cd786aa76890c8e687d2353393bc16c78ec4d"},
+      {&ec_hash_to_curve_p384_xmd_sha512_sswu_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SSWU_RO_TESTGEN",
        "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
@@ -1166,55 +1166,17 @@
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-       "1b669293d6edfd55ca7f9725d72fc62b55a8829738404a1239f2ca"
-       "783ad8f8a3ebe2ce54a28fcb6e9eca85d1ce29a929",
-       "25556bc2c6382c261feb362519f1e5d616518810262c358fb80e45"
-       "803ebcd0ce830b594da7a0e9de9eb13ad2d9191d34"},
+       "41941db59a7b8b633bd5bfa462f1e29a9f18e5a341445d90fc6eb9"
+       "37f2913224287b9dfb64742851f760eb14ca115ff9",
+       "1510e764f1be968d661b7aaecb26a6d38c98e5205ca150f0ae426d"
+       "2c3983c68e3a9ffb283c6ae4891d891b5705500475"},
 
-      // See draft-irtf-cfrg-hash-to-curve-06, appendix G.3.1. Note these tests
-      // use |ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing| due to a
+      // Note these tests do not match the tests vectors
+      // draft-irtf-cfrg-hash-to-curve-06 due to a
       // spec issue. See
-      // https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/issues/237. We
-      // expose and test this function to check our consistency with the rest of
-      // the reference implementation.
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing, NID_secp521r1,
-       "P521_XMD:SHA-512_SSWU_RO_TESTGEN", "",
-       "00ad6cb736cb0565a2b6c52dd9e53f76a9a40a44c73bfaacef03c3"
-       "ef62a9a23920b7df4de1b92754de7bb3013d9d36049da001136e7f"
-       "4b1b0ba10beac862a2b3d3c5",
-       "01c2ecab1b6f7bb6797a4b5bd416b385e891926fc17f230f2406f3"
-       "d47076526c5d90bfb4d0170fd8a339de1a66e6304d280d0404fb68"
-       "5b2ca07e2742a770b681bf56"},
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing, NID_secp521r1,
-       "P521_XMD:SHA-512_SSWU_RO_TESTGEN", "abcdef0123456789",
-       "019f0195e514da4243a4d2de4b7ed2415d5205c6da11eb7deae70b"
-       "e78a61bb89ebf17f7c9970ee20b4152ae50c95e55f626bc7350d5a"
-       "0f530a91f48047bd90eeeaa7",
-       "016eaa02cd5511a96eed4ffc965bdc3f1fdbb7f4c9895eabdf168b"
-       "44250278ebca55474bc89a2f246b8fb959010502aab8a9385319bc"
-       "f69f74dd8f518bea1c7fafde"},
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu_ref_for_testing, NID_secp521r1,
-       "P521_XMD:SHA-512_SSWU_RO_TESTGEN",
-       "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-       "00de3dd7780cfcd538f7b3067d8da52c522a031244dc0d327e6e99"
-       "ef331be475354a0b481a22e0d4d35b232da260baac5b693a827a20"
-       "b1f328a416ffc47ad945a4dc",
-       "016bb6c5c965c6a80a4a5e0c2c7bbd841766eac695f88a730076b3"
-       "2d4399da01609a4a17b59a21f4f58a174d6110081b96e5aaedead3"
-       "cfd4252e74de969680ba74ab"},
-
-      // The above test vectors with the expectations updated to compute
-      // hash_to_field correctly.
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu, NID_secp521r1,
+      // https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/pull/238 for
+      // corrected test vectors.
+      {&ec_hash_to_curve_p521_xmd_sha512_sswu_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SSWU_RO_TESTGEN", "",
        "00758617b5e40aa8b30fcfd3c7453ad1abeff158de5697d6f1ccb8"
        "4690aaa8bb6692986200d16206e85e4f39f1d2829fee1a5904a089"
@@ -1222,7 +1184,15 @@
        "016edf324d95fcbe4a30f06751f16cdd5d0b49921dd653cefb3ea2"
        "dc2b5b903e36d9924a65407283588cc6c224ab6d6324c73cdc166c"
        "e1530b46984b459e966349b3"},
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu, NID_secp521r1,
+      {&ec_hash_to_curve_p521_xmd_sha512_sswu_draft06, NID_secp521r1,
+       "P521_XMD:SHA-512_SSWU_RO_TESTGEN", "abc",
+       "00dcec1a83b676247293e96b1672f67aa5d041a4ded49f542a971a"
+       "60603dd39194f4d8e587f640563a9ab57dcc69af638129b220683f"
+       "f03ed9ad8cfdff3833a01452",
+       "01edc4b497be85361a0afc508058792dc7fc6499a4c51fa3475093"
+       "fd9951ea46fe055e1b007a12caf9be1ce3028bd0b4ca4ffa5200f9"
+       "d11e7fc96e068276ad1319c2"},
+      {&ec_hash_to_curve_p521_xmd_sha512_sswu_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SSWU_RO_TESTGEN", "abcdef0123456789",
        "01f58bfb34825d028c392976a09cebee829734f7714c84b8a13580"
        "afcc2eb4726e18e307476c1fccdc857a3d6767fd2882875ab132b7"
@@ -1230,7 +1200,7 @@
        "00ee0d2d0bfb0bdc6215814fe7096a3dfbf020dce4f0645e8e21a9"
        "0d6a6113a5ca61ae7d8f3b485b04f2eb2b85e34fc7f9f1bf367386"
        "2e03932b0acc3655e84d480f"},
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu, NID_secp521r1,
+      {&ec_hash_to_curve_p521_xmd_sha512_sswu_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SSWU_RO_TESTGEN",
        "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
@@ -1250,7 +1220,7 @@
        "7351a76fce44347c72a6fe9a"},
 
       // Custom test vector which triggers long DST path.
-      {&ec_hash_to_curve_p521_xmd_sha512_sswu, NID_secp521r1,
+      {&ec_hash_to_curve_p521_xmd_sha512_sswu_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SSWU_RO_TESTGEN_aaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
@@ -1299,9 +1269,9 @@
   EC_RAW_POINT p;
   static const uint8_t kDST[] = {0, 1, 2, 3};
   static const uint8_t kMessage[] = {4, 5, 6, 7};
-  EXPECT_FALSE(ec_hash_to_curve_p521_xmd_sha512_sswu(
+  EXPECT_FALSE(ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
       p224.get(), &p, kDST, sizeof(kDST), kMessage, sizeof(kMessage)));
-  EXPECT_FALSE(ec_hash_to_curve_p384_xmd_sha512_sswu(
+  EXPECT_FALSE(ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
       p224.get(), &p, kDST, sizeof(kDST), kMessage, sizeof(kMessage)));
 }
 
@@ -1316,15 +1286,15 @@
     const char *result_hex;
   };
   static const HashToScalarTest kTests[] = {
-      {&ec_hash_to_scalar_p384_xmd_sha512, NID_secp384r1,
+      {&ec_hash_to_scalar_p384_xmd_sha512_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SCALAR_TEST", "",
-       "55f24775dd8ec265d9d1bf2f25b83806daf119db8646b3d263b156"
-       "8dbae4ee54aeafc757e4aa197da85504ad124d8ac8"},
-      {&ec_hash_to_scalar_p384_xmd_sha512, NID_secp384r1,
+       "9687acc2de56c3cf94c0e05b6811a21aa480092254ec0532bdce63"
+       "140ecd340f09dc2d45d77e21fb0aa76f7707b8a676"},
+      {&ec_hash_to_scalar_p384_xmd_sha512_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SCALAR_TEST", "abcdef0123456789",
-       "3af11c58bf0a3ee3560207c6bed9b5ecca5dc330426a6e1a601d36"
-       "c15d3818aeb48afb182036750bc5b46e6c20e8e2ff"},
-      {&ec_hash_to_scalar_p384_xmd_sha512, NID_secp384r1,
+       "8f8076022a68233cbcecaceae68c2068f132724f001caa78619eff"
+       "1ffc58fa871db73fe9034fc9cf853c384ed34b5666"},
+      {&ec_hash_to_scalar_p384_xmd_sha512_draft07, NID_secp384r1,
        "P384_XMD:SHA-512_SCALAR_TEST",
        "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
@@ -1336,19 +1306,19 @@
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-       "2d5f927d15283f89d9d4932f93b77ab837e90bdf26b5f8beb2c794"
-       "bbd83032b6f1a445ef9f343a2b9311657e86e6ad43"},
-      {&ec_hash_to_scalar_p521_xmd_sha512, NID_secp521r1,
+       "750f2fae7d2b2f41ac737d180c1d4363d85a1504798b4976d40921"
+       "1ddb3651c13a5b4daba9975cdfce18336791131915"},
+      {&ec_hash_to_scalar_p521_xmd_sha512_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SCALAR_TEST", "",
        "01a6206c2fc677c11d51807bf46d64a17f92396673074c5cee9299"
        "4d28eec5445d5ed89799b30b39c964ecf62f39d59e7d43de15d910"
        "c2c1d69f3ebc01eab241e5dc"},
-      {&ec_hash_to_scalar_p521_xmd_sha512, NID_secp521r1,
+      {&ec_hash_to_scalar_p521_xmd_sha512_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SCALAR_TEST", "abcdef0123456789",
        "00af484a5d9389a9912f555234c578d4b1b7c4a6f5009018d133a4"
        "069172c9f5ce2d853b8643fe7bb50a83427ed3520a7a793c41a455"
        "a02aa99431434fb6b5b0b26e"},
-      {&ec_hash_to_scalar_p521_xmd_sha512, NID_secp521r1,
+      {&ec_hash_to_scalar_p521_xmd_sha512_draft06, NID_secp521r1,
        "P521_XMD:SHA-512_SCALAR_TEST",
        "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
@@ -1388,8 +1358,8 @@
   EC_SCALAR scalar;
   static const uint8_t kDST[] = {0, 1, 2, 3};
   static const uint8_t kMessage[] = {4, 5, 6, 7};
-  EXPECT_FALSE(ec_hash_to_scalar_p521_xmd_sha512(
+  EXPECT_FALSE(ec_hash_to_scalar_p521_xmd_sha512_draft06(
       p224.get(), &scalar, kDST, sizeof(kDST), kMessage, sizeof(kMessage)));
-  EXPECT_FALSE(ec_hash_to_scalar_p384_xmd_sha512(
+  EXPECT_FALSE(ec_hash_to_scalar_p384_xmd_sha512_draft07(
       p224.get(), &scalar, kDST, sizeof(kDST), kMessage, sizeof(kMessage)));
 }
diff --git a/crypto/trust_token/pmbtoken.c b/crypto/trust_token/pmbtoken.c
index 4b9451d..192eba9 100644
--- a/crypto/trust_token/pmbtoken.c
+++ b/crypto/trust_token/pmbtoken.c
@@ -293,7 +293,7 @@
 static int hash_t(EC_GROUP *group, EC_RAW_POINT *out,
                   const uint8_t t[PMBTOKEN_NONCE_SIZE]) {
   const uint8_t kHashTLabel[] = "PMBTokensV0 HashT";
-  return ec_hash_to_curve_p521_xmd_sha512_sswu(
+  return ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
       group, out, kHashTLabel, sizeof(kHashTLabel), t, PMBTOKEN_NONCE_SIZE);
 }
 
@@ -310,8 +310,8 @@
       !point_to_cbb(&cbb, group, t) ||
       !CBB_add_bytes(&cbb, s, PMBTOKEN_NONCE_SIZE) ||
       !CBB_finish(&cbb, &buf, &len) ||
-      !ec_hash_to_curve_p521_xmd_sha512_sswu(group, out, kHashSLabel,
-                                             sizeof(kHashSLabel), buf, len)) {
+      !ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
+          group, out, kHashSLabel, sizeof(kHashSLabel), buf, len)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, ERR_R_MALLOC_FAILURE);
     goto err;
   }
@@ -367,8 +367,8 @@
 static int hash_c(const EC_GROUP *group, EC_SCALAR *out, uint8_t *buf,
                   size_t len) {
   const uint8_t kHashCLabel[] = "PMBTokensV0 HashC";
-  return ec_hash_to_scalar_p521_xmd_sha512(group, out, kHashCLabel,
-                                           sizeof(kHashCLabel), buf, len);
+  return ec_hash_to_scalar_p521_xmd_sha512_draft06(
+      group, out, kHashCLabel, sizeof(kHashCLabel), buf, len);
 }
 
 static int scalar_to_cbb(CBB *out, const EC_GROUP *group,
diff --git a/tool/speed.cc b/tool/speed.cc
index f403fe8..c91c25b 100644
--- a/tool/speed.cc
+++ b/tool/speed.cc
@@ -962,7 +962,7 @@
     }
     if (!TimeFunction(&results, [&]() -> bool {
           EC_RAW_POINT out;
-          return ec_hash_to_curve_p521_xmd_sha512_sswu(
+          return ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
               group, &out, kLabel, sizeof(kLabel), input, sizeof(input));
         })) {
       fprintf(stderr, "hash-to-curve failed.\n");
@@ -972,7 +972,7 @@
 
     if (!TimeFunction(&results, [&]() -> bool {
           EC_SCALAR out;
-          return ec_hash_to_scalar_p521_xmd_sha512(
+          return ec_hash_to_scalar_p521_xmd_sha512_draft06(
               group, &out, kLabel, sizeof(kLabel), input, sizeof(input));
         })) {
       fprintf(stderr, "hash-to-scalar failed.\n");
@@ -988,7 +988,7 @@
     }
     if (!TimeFunction(&results, [&]() -> bool {
           EC_RAW_POINT out;
-          return ec_hash_to_curve_p384_xmd_sha512_sswu(
+          return ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
               group, &out, kLabel, sizeof(kLabel), input, sizeof(input));
         })) {
       fprintf(stderr, "hash-to-curve failed.\n");
@@ -998,7 +998,7 @@
 
     if (!TimeFunction(&results, [&]() -> bool {
           EC_SCALAR out;
-          return ec_hash_to_scalar_p384_xmd_sha512(
+          return ec_hash_to_scalar_p384_xmd_sha512_draft07(
               group, &out, kLabel, sizeof(kLabel), input, sizeof(input));
         })) {
       fprintf(stderr, "hash-to-scalar failed.\n");