Re: [Cfrg] [Errata Verified] RFC8032 (5519)

It seems there is another typo in 5.1.7, as public key and its encoding are
confused:

Decode the first half as a
       point R, and the second half as an integer S, in the range
       0 <= s < L.  Decode the public key A as point A'.  If any of the
       decodings fail (including S being out of range), the signature is
       invalid.

   2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
       64-octet digest as a little-endian integer k.

   3.  Check the group equation [8][S]B = [8]R + [8][k]A'.  It's
       sufficient, but not required, to instead check [S]B = R + [k]A'.

Should be

Decode the first half R as a
       point R`, and the second half as an integer S, in the range
       0 <= S < L.  Decode the public key A as point A'.  If any of the
       decodings fail (including S being out of range), the signature is
       invalid.

   2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
       64-octet digest as a little-endian integer k.

   3.  Check the group equation [8][S]B = [8]R` + [8][k]A'.  It's
       sufficient, but not required, to instead check [S]B = R` + [k]A'.

Dmitry Khovratovich

On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <rfc-editor@rfc-editor.org>
wrote:

> The following errata report has been verified for RFC8032,
> "Edwards-Curve Digital Signature Algorithm (EdDSA)".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5519
>
> --------------------------------------
> Status: Verified
> Type: Editorial
>
> Reported by: Susumu Endoh <sus-e@ubiquitous-ai.com>
> Date Reported: 2018-10-10
> Verified by: Colin Perkins (IRSG)
>
> Section: 5.1.7
>
> Original Text
> -------------
> Decode the first half as a point R, and the second half as an integer S,
> in the range 0 <= s < L.
>
>
> Corrected Text
> --------------
> Decode the first half as a point R, and the second half as an integer S,
> in the range 0 <= S < L.
>
>
> Notes
> -----
> original document expression is ' 0 <= s < L', but it must be '0 <= S <
> L'. upper/lower case problem.
>
> --------------------------------------
> RFC8032 (draft-irtf-cfrg-eddsa-08)
> --------------------------------------
> Title               : Edwards-Curve Digital Signature Algorithm (EdDSA)
> Publication Date    : January 2017
> Author(s)           : S. Josefsson, I. Liusvaara
> Category            : INFORMATIONAL
> Source              : Crypto Forum Research Group
> Area                : N/A
> Stream              : IRTF
> Verifying Party     : IRSG
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Best regards,
Dmitry Khovratovich