Subject: Re: [Cfrg] [Errata Verified] RFC8032 (5519)

From: Dmitry Khovratovich <[email-masked]>
Date: Thu, 23 Jul 2020 14:43:39 +0200

It seems there is another typo in 5.1.7, as public key and its encoding are
confused:

Decode the first half as a
       point R, and the second half as an integer S, in the range
       0 <= s < L.  Decode the public key A as point A'.  If any of the
       decodings fail (including S being out of range), the signature is
       invalid.

   2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
       64-octet digest as a little-endian integer k.

   3.  Check the group equation [8][S]B = [8]R + [8][k]A'.  It's
       sufficient, but not required, to instead check [S]B = R + [k]A'.

Should be

Decode the first half R as a
       point R`, and the second half as an integer S, in the range
       0 <= S < L.  Decode the public key A as point A'.  If any of the
       decodings fail (including S being out of range), the signature is
       invalid.

   2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
       64-octet digest as a little-endian integer k.

   3.  Check the group equation [8][S]B = [8]R` + [8][k]A'.  It's
       sufficient, but not required, to instead check [S]B = R` + [k]A'.

Dmitry Khovratovich

On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <[email-masked]>
wrote:

> The following errata report has been verified for RFC8032,
> "Edwards-Curve Digital Signature Algorithm (EdDSA)".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5519
>
> --------------------------------------
> Status: Verified
> Type: Editorial
>
> Reported by: Susumu Endoh <[email-masked]>
> Date Reported: 2018-10-10
> Verified by: Colin Perkins (IRSG)
>
> Section: 5.1.7
>
> Original Text
> -------------
> Decode the first half as a point R, and the second half as an integer S,
> in the range 0 <= s < L.
>
>
> Corrected Text
> --------------
> Decode the first half as a point R, and the second half as an integer S,
> in the range 0 <= S < L.
>
>
> Notes
> -----
> original document expression is ' 0 <= s < L', but it must be '0 <= S <
> L'. upper/lower case problem.
>
> --------------------------------------
> RFC8032 (draft-irtf-cfrg-eddsa-08)
> --------------------------------------
> Title               : Edwards-Curve Digital Signature Algorithm (EdDSA)
> Publication Date    : January 2017
> Author(s)           : S. Josefsson, I. Liusvaara
> Category            : INFORMATIONAL
> Source              : Crypto Forum Research Group
> Area                : N/A
> Stream              : IRTF
> Verifying Party     : IRSG
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Best regards,
Dmitry Khovratovich

---

From: Colin Perkins <[email-masked]>
Date: Mon, 27 Jul 2020 22:51:54 +0100

Thanks, Dimity.

Can someone else in the RG double-check to confirm? Once that’s done, I can work with the RFC Editor to get correct fix recorded.

Colin

> On 23 Jul 2020, at 13:43, Dmitry Khovratovich <[email-masked]> wrote:
> 
> It seems there is another typo in 5.1.7, as public key and its encoding are confused:
> 
> On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <[email-masked] <mailto:[email-masked]>> wrote:
> http://www.rfc-editor.org/errata/eid5519 <http://www.rfc-editor.org/errata/eid5519>
> 
> Reported by: Susumu Endoh <[email-masked] <mailto:[email-masked]>>
> original document expression is ' 0 <= s < L', but it must be '0 <= S < L'. upper/lower case problem.
> 
> [email-masked] <mailto:[email-masked]>
> https://www.irtf.org/mailman/listinfo/cfrg <https://www.irtf.org/mailman/listinfo/cfrg>
> 
> 
> -- 
> Best regards,
> Dmitry Khovratovich

-- 
Colin Perkins
https://csperkins.org/

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Tue, 28 Jul 2020 09:38:06 +0300

Dear Colin and Dmitry,

I agree with both changes (one about "S" instead of "s" in the inequality,
the other about R' instead of R to keep the same notation as in 5.1.6)
proposed by Dmitry.

Regards,
Stanislav

On Tue, 28 Jul 2020 at 00:52, Colin Perkins <[email-masked]> wrote:

> Thanks, Dimity.
>
> Can someone else in the RG double-check to confirm? Once that’s done, I
> can work with the RFC Editor to get correct fix recorded.
>
> Colin
>
>
>
> On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <
> [email-masked]> wrote:
>

---

From: Dmitry Khovratovich <[email-masked]>
Date: Tue, 28 Jul 2020 11:05:20 +0200

I just realized I used an apostrophe different from the one in the text, so
it should be changed probably.

-- 
Best regards,
Dmitry Khovratovich