Subject: [CFRG] [Errata Rejected] RFC7748 (5651)

From: RFC Errata System <[email-masked]>
Date: Mon, 14 Dec 2020 23:06:31 -0800 (PST)

The following errata report has been rejected for RFC7748,
"Elliptic Curves for Security".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid5651

--------------------------------------
Status: Rejected
Type: Technical

Reported by: Pierre Laurent <[email-masked]>
Date Reported: 2019-03-11
Rejected by: Stanislav Smyshlyaev (IRSG)

Section: 5

Original Text
-------------
z_2 = E * (AA + a24 * E)

Corrected Text
--------------
z_2 = E * (BB + a24 * E)

Notes
-----
When BB is used, the point multiplication of the second test vector

P = (0x13a415c749d54cfc3e3cc06f10e7db312cae38059d95b7f4d3116878120f21e5, 0x1) 

by scalar k
0x4dba18799e16a42cd401eae021641bc1f56a7d959126d25a3c67b4d1d4e96648

gives the expected point
[k]P = (0x5779ac7a64f7f8e652a19f79685a598bf873b8b45ce4ad7a7d90e87694decb95, 0x1)

The implementation based on AA gives the unexpected point 
[k]P = (0x3884d5c22af664f822cb3dd728b03c9fac1e1d78c772a74f05546566bd7bed9c, 1)
 --VERIFIER NOTES-- 
It is proposed to modify the algorithm description for calculation of z_2. However, after checking the original algorithm independently, it was confirmed that the expected numbers are obtained. Therefore, the existing text of RFC does not have any errors here.

--------------------------------------
RFC7748 (draft-irtf-cfrg-curves-11)
--------------------------------------
Title               : Elliptic Curves for Security
Publication Date    : January 2016
Author(s)           : A. Langley, M. Hamburg, S. Turner
Category            : INFORMATIONAL
Source              : Crypto Forum Research Group
Area                : N/A
Stream              : IRTF
Verifying Party     : IRSG