Re: [Cfrg] [irsg] [Errata Verified] RFC8032 (5519)

Dear Colin and Dmitry,

I agree with both changes (one about "S" instead of "s" in the inequality,
the other about R' instead of R to keep the same notation as in 5.1.6)
proposed by Dmitry.

Regards,
Stanislav

On Tue, 28 Jul 2020 at 00:52, Colin Perkins <csp@csperkins.org> wrote:

> Thanks, Dimity.
>
> Can someone else in the RG double-check to confirm? Once that’s done, I
> can work with the RFC Editor to get correct fix recorded.
>
> Colin
>
>
>
> On 23 Jul 2020, at 13:43, Dmitry Khovratovich <khovratovich@gmail.com>
> wrote:
>
> It seems there is another typo in 5.1.7, as public key and its encoding
> are confused:
>
> Decode the first half as a
>        point R, and the second half as an integer S, in the range
>        0 <= s < L.  Decode the public key A as point A'.  If any of the
>        decodings fail (including S being out of range), the signature is
>        invalid.
>
>    2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
>        64-octet digest as a little-endian integer k.
>
>    3.  Check the group equation [8][S]B = [8]R + [8][k]A'.  It's
>        sufficient, but not required, to instead check [S]B = R + [k]A'.
>
>
>
> Should be
>
>
> Decode the first half R as a
>        point R`, and the second half as an integer S, in the range
>        0 <= S < L.  Decode the public key A as point A'.  If any of the
>        decodings fail (including S being out of range), the signature is
>        invalid.
>
>    2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
>        64-octet digest as a little-endian integer k.
>
>    3.  Check the group equation [8][S]B = [8]R` + [8][k]A'.  It's
>        sufficient, but not required, to instead check [S]B = R` + [k]A'.
>
>
> Dmitry Khovratovich
>
>
> On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <
> rfc-editor@rfc-editor.org> wrote:
>
>> The following errata report has been verified for RFC8032,
>> "Edwards-Curve Digital Signature Algorithm (EdDSA)".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata/eid5519
>>
>> --------------------------------------
>> Status: Verified
>> Type: Editorial
>>
>> Reported by: Susumu Endoh <sus-e@ubiquitous-ai.com>
>> Date Reported: 2018-10-10
>> Verified by: Colin Perkins (IRSG)
>>
>> Section: 5.1.7
>>
>> Original Text
>> -------------
>> Decode the first half as a point R, and the second half as an integer S,
>> in the range 0 <= s < L.
>>
>>
>> Corrected Text
>> --------------
>> Decode the first half as a point R, and the second half as an integer S,
>> in the range 0 <= S < L.
>>
>>
>> Notes
>> -----
>> original document expression is ' 0 <= s < L', but it must be '0 <= S <
>> L'. upper/lower case problem.
>>
>> --------------------------------------
>> RFC8032 (draft-irtf-cfrg-eddsa-08)
>> --------------------------------------
>> Title               : Edwards-Curve Digital Signature Algorithm (EdDSA)
>> Publication Date    : January 2017
>> Author(s)           : S. Josefsson, I. Liusvaara
>> Category            : INFORMATIONAL
>> Source              : Crypto Forum Research Group
>> Area                : N/A
>> Stream              : IRTF
>> Verifying Party     : IRSG
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>>
>
>
> --
> Best regards,
> Dmitry Khovratovich
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
>
>
>
> --
> Colin Perkins
> https://csperkins.org/
>
>
>
>
>