[CFRG] [Technical Errata Reported] RFC9497 (7925)

[RFC Errata System <[e-mail]>]

The following errata report has been submitted for RFC9497,
"Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7925

--------------------------------------
Type: Technical
Reported by: Stefan Santesson <[e-mail]>

Section: 4.3

Original Text
-------------
HashToScalar():  Use hash_to_field from [RFC9380] using L = 48,
         expand_message_xmd with SHA-256, DST = "HashToScalar-" ||
         contextString, and a prime modulus equal to Group.Order().

Corrected Text
--------------
HashToScalar():  Compute uniform_bytes using expand_message =
         expand_message_xmd, DST = "HashToScalar-" || contextString, and
         an output length of 48 bytes, interpret uniform_bytes as a
         384-bit integer in little-endian order, and reduce the integer
         modulo Group.Order().

Notes
-----
It is incorrect to refer to the hash_to_filed operation of RFC 9380 because the implementation of hash_to_field, as described in section 5.2 of RFC 9380 reduces the result integer mod Field order (not Group order).

 7.     e_j = OS2IP(tv) mod p

Where p is the characteristic of field F.

The current text imply that the existing hash_to_field implementation for P-256 can be used. But using this will cause a false result due to the mod field order operation.

The a better, and accurate way to describe this is by using the same explanation as for other curve types and specify the use of expand_message_xmd directly modulus Group.Order().

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it 
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC9497 (draft-irtf-cfrg-voprf-21)
--------------------------------------
Title               : Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups
Publication Date    : December 2023
Author(s)           : A. Davidson, A. Faz-Hernandez, N. Sullivan, C. A. Wood
Category            : INFORMATIONAL
Source              : Crypto Forum Research Group
Stream              : IRTF
Verifying Party     : IRSG