Re: [CFRG] [Technical Errata Reported] RFC7748 (7879)

[Mike Hamburg <[e-mail]>]

Hello Nawras,

Thanks for reporting this. The calculation can be done with either AA setting “a24” = (A-2)/4, or with BB setting “a24” = (A+2)/4.  Both calculations appear in the literature.  We happened to follow the Curve25519 paper instead of the original Montgomery paper when making the RFC.

See eg https://crypto.stackexchange.com/questions/67942/difference-on-montgomery-curve-equation-between-efd-and-rfc7748

Regards,
— Mike

> On Apr 2, 2024, at 16:22, RFC Errata System <[e-mail]> wrote:
> 
> The following errata report has been submitted for RFC7748,
> "Elliptic Curves for Security".
> 
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7879
> 
> --------------------------------------
> Type: Technical
> Reported by: Nawras Hussein Sabbry <[e-mail]>
> 
> Section: 5
> 
> Original Text
> -------------
> z_2 = E * (AA + a24 * E)
> 
> Corrected Text
> --------------
> z_2 = E * (BB + a24 * E)
> 
> Notes
> -----
> In the for loop on page 8, the variable AA should be replaced with BB in Z_2. This modification is necessary because the mathematical formula for point doubling on the Montgomery curve according to (https://en.wikipedia.org/wiki/Montgomery_curve#Montgomery_arithmetic) indicates that Z2n (equivalent to Z_2 in this case) is calculated as follows: Z2n = 4XnZn((Xn-Zn)^2 + ((A+2)/4)(4XnZn)). It is observed in this equation that the operation in the (Xn-Zn)^2 part involves subtraction similar to the variable B, while the operation in the variable A involves addition. Considering this discrepancy, it is suggested to substitute AA with BB for correctness.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". (If it is spam, it
> will be removed shortly by the RFC Production Center.) Please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> will log in to change the status and edit the report, if necessary.
> 
> --------------------------------------
> RFC7748 (draft-irtf-cfrg-curves-11)
> --------------------------------------
> Title               : Elliptic Curves for Security
> Publication Date    : January 2016
> Author(s)           : A. Langley, M. Hamburg, S. Turner
> Category            : INFORMATIONAL
> Source              : Crypto Forum Research Group
> Stream              : IRTF
> Verifying Party     : IRSG