Re: [Cfrg] [irsg] [Errata Verified] RFC8032 (5519)

I just realized I used an apostrophe different from the one in the text, so
it should be changed probably.

On Tue, Jul 28, 2020 at 8:38 AM Stanislav V. Smyshlyaev <smyshsv@gmail.com>
wrote:

> Dear Colin and Dmitry,
>
> I agree with both changes (one about "S" instead of "s" in the inequality,
> the other about R' instead of R to keep the same notation as in 5.1.6)
> proposed by Dmitry.
>
> Regards,
> Stanislav
>
> On Tue, 28 Jul 2020 at 00:52, Colin Perkins <csp@csperkins.org> wrote:
>
>> Thanks, Dimity.
>>
>> Can someone else in the RG double-check to confirm? Once that’s done, I
>> can work with the RFC Editor to get correct fix recorded.
>>
>> Colin
>>
>>
>>
>> On 23 Jul 2020, at 13:43, Dmitry Khovratovich <khovratovich@gmail.com>
>> wrote:
>>
>> It seems there is another typo in 5.1.7, as public key and its encoding
>> are confused:
>>
>> Decode the first half as a
>>        point R, and the second half as an integer S, in the range
>>        0 <= s < L.  Decode the public key A as point A'.  If any of the
>>        decodings fail (including S being out of range), the signature is
>>        invalid.
>>
>>    2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
>>        64-octet digest as a little-endian integer k.
>>
>>    3.  Check the group equation [8][S]B = [8]R + [8][k]A'.  It's
>>        sufficient, but not required, to instead check [S]B = R + [k]A'.
>>
>>
>>
>> Should be
>>
>>
>> Decode the first half R as a
>>        point R`, and the second half as an integer S, in the range
>>        0 <= S < L.  Decode the public key A as point A'.  If any of the
>>        decodings fail (including S being out of range), the signature is
>>        invalid.
>>
>>    2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
>>        64-octet digest as a little-endian integer k.
>>
>>    3.  Check the group equation [8][S]B = [8]R` + [8][k]A'.  It's
>>        sufficient, but not required, to instead check [S]B = R` + [k]A'.
>>
>>
>> Dmitry Khovratovich
>>
>>
>> On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <
>> rfc-editor@rfc-editor.org> wrote:
>>
>>> The following errata report has been verified for RFC8032,
>>> "Edwards-Curve Digital Signature Algorithm (EdDSA)".
>>>
>>> --------------------------------------
>>> You may review the report below and at:
>>> http://www.rfc-editor.org/errata/eid5519
>>>
>>> --------------------------------------
>>> Status: Verified
>>> Type: Editorial
>>>
>>> Reported by: Susumu Endoh <sus-e@ubiquitous-ai.com>
>>> Date Reported: 2018-10-10
>>> Verified by: Colin Perkins (IRSG)
>>>
>>> Section: 5.1.7
>>>
>>> Original Text
>>> -------------
>>> Decode the first half as a point R, and the second half as an integer S,
>>> in the range 0 <= s < L.
>>>
>>>
>>> Corrected Text
>>> --------------
>>> Decode the first half as a point R, and the second half as an integer S,
>>> in the range 0 <= S < L.
>>>
>>>
>>> Notes
>>> -----
>>> original document expression is ' 0 <= s < L', but it must be '0 <= S <
>>> L'. upper/lower case problem.
>>>
>>> --------------------------------------
>>> RFC8032 (draft-irtf-cfrg-eddsa-08)
>>> --------------------------------------
>>> Title               : Edwards-Curve Digital Signature Algorithm (EdDSA)
>>> Publication Date    : January 2017
>>> Author(s)           : S. Josefsson, I. Liusvaara
>>> Category            : INFORMATIONAL
>>> Source              : Crypto Forum Research Group
>>> Area                : N/A
>>> Stream              : IRTF
>>> Verifying Party     : IRSG
>>>
>>> _______________________________________________
>>> Cfrg mailing list
>>> Cfrg@irtf.org
>>> https://www.irtf.org/mailman/listinfo/cfrg
>>>
>>
>>
>> --
>> Best regards,
>> Dmitry Khovratovich
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>>
>>
>>
>>
>> --
>> Colin Perkins
>> https://csperkins.org/
>>
>>
>>
>>
>>

-- 
Best regards,
Dmitry Khovratovich