[CFRG] [Errata Verified] RFC9591 (9208)

rfc-editor@rfc-editor.org Wed, 07 October 2026 19:13 UTC

Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: rfc-editor@rfc-editor.org
To: durumcrustulum@gmail.com, iang@uwaterloo.ca, elichai.turkel@gmail.com, ckomlo@uwaterloo.ca, caw@heapingbits.net
Date: Wed, 07 Oct 2026 19:13:25 -0000
message-id: <179140040525.11.5184433361506070422@rfc-editor.org>
Message-ID-Hash: 2YV26VMM7NU3SZXOYGRGPWQN463FA7BU
CC: rfc-editor@rfc-editor.org, cfrg@ietf.org, irsg@irtf.org, iana@iana.org
Precedence: list
Subject: [CFRG] [Errata Verified] RFC9591 (9208)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/C_7pz7pgToLZHuDNmOXgUKOJlXs>

The following errata report has been verified for RFC9591,
"The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures"

--------------------------------------
You may review the report below and at:
https://errata.rfc-editor.org/eid9208/

--------------------------------------

Status: Verified
Type: Editorial
Reported by: Elichai Turkel <elichai.turkel@gmail.com>
Date Reported: Oct. 7, 2026, 11:33 a.m.
Verified by: Madison Church (RFC Production Center)

Section 6.3 says:

Original Text
-------------
This ciphersuite uses edwards448 for the Group and SHAKE256 for the hash function H meant to produce Ed448-compliant signatures as specified in Section 5.2
 of [RFC8032]. Unlike Ed448 in [RFC8032], this ciphersuite does not allow applications to specify a context string and always sets the context of [RFC8032] to the
 empty string. Note that this ciphersuite does not allow applications to specify a context string as is allowed for Ed448 in [RFC8032], and always sets the [RFC8032]
 context string to the empty string. The value of the (internal to FROST) contextString parameter is "FROST-ED448-SHAKE256-v1".

Corrected Text
--------------
This ciphersuite uses edwards448 for the Group and SHAKE256 for the hash function H meant to produce Ed448-compliant signatures as specified in Section 5.2
 of [RFC8032]. Unlike Ed448 in [RFC8032], this ciphersuite does not allow applications to specify a context string and always sets the context of [RFC8032] to the
 empty string. The value of the (internal to FROST) contextString parameter is "FROST-ED448-SHAKE256-v1".

Notes
-----
The sentence "this ciphersuite does not allow applications to specify a context string as is allowed for Ed448 in [RFC8032], and always sets the [RFC8032] context string to the empty string." appears twice, one after another

--------------------------------------
RFC9591 (draft-irtf-cfrg-frost)
--------------------------------------
Title               : The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures
Publication Date    : June 2024
Author(s)           : D. Connolly, C. Komlo, I. Goldberg, C. A. Wood
Category            : Informational
Source              : cfrg (irtf)
Stream              : IRTF

[CFRG] [Errata Verified] RFC9591 (9208) rfc-editor