[CFRG] [Errata Verified] RFC9497 (8392)

RFC Errata System <rfc-editor@rfc-editor.org> Tue, 27 January 2026 20:38 UTC

Return-Path: <wwwrun@rfcpa.rfc-editor.org>
X-Original-To: cfrg@irtf.org
Delivered-To: cfrg@mail2.ietf.org
Received: from rfcpa.rfc-editor.org (unknown [167.172.21.234]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 1B7A4ADED7DA; Tue, 27 Jan 2026 12:38:26 -0800 (PST)
Received: by rfcpa.rfc-editor.org (Postfix, from userid 461) id 009F4C000CE0; Tue, 27 Jan 2026 12:38:25 -0800 (PST)
To: daxpedda@gmail.com, alex.davidson92@gmail.com, armfazh@cloudflare.com, nicholas.sullivan+ietf@gmail.com, caw@heapingbits.net
From: RFC Errata System <rfc-editor@rfc-editor.org>
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20260127203826.009F4C000CE0@rfcpa.rfc-editor.org>
Date: Tue, 27 Jan 2026 12:38:25 -0800
Message-ID-Hash: YG7LI2VZPDORJVUVIFXX73JAST7M47IH
X-Message-ID-Hash: YG7LI2VZPDORJVUVIFXX73JAST7M47IH
X-MailFrom: wwwrun@rfcpa.rfc-editor.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-cfrg.irtf.org-0; header-match-cfrg.irtf.org-1; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: irsg@irtf.org, cfrg@irtf.org, iana@iana.org, rfc-editor@rfc-editor.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [CFRG] [Errata Verified] RFC9497 (8392)
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/SotHCoaMpgq0jByz66LWwrx48G4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Owner: <mailto:cfrg-owner@irtf.org>
List-Post: <mailto:cfrg@irtf.org>
List-Subscribe: <mailto:cfrg-join@irtf.org>
List-Unsubscribe: <mailto:cfrg-leave@irtf.org>

The following errata report has been verified for RFC9497,
"Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8392

--------------------------------------
Status: Verified
Type: Technical

Reported by: daxpedda <daxpedda@gmail.com>
Date Reported: 2025-04-25
Verified by: Nick Sullivan (IRSG)

Section: 4

Original Text
-------------
RandomScalar():  Implemented by returning a uniformly random
         Scalar in the range [0, G.Order() - 1].

Corrected Text
--------------
RandomScalar():  Implemented by returning a uniformly random
         Scalar in the range [1, G.Order() - 1].

Notes
-----
Section 2.1 (https://www.rfc-editor.org/rfc/rfc9497#section-2.1-4.12) states:
> Chooses at random a nonzero element in GF(p).

So `RandomScalar()` implementations can't return 0.

--VERIFIER NOTE--
Verified. Section 2.1 requires nonzero; this fix aligns Section 4 with that requirement. EID 8393 addresses related Section 4.7 implementation guidance (held pending fix text revision).

--------------------------------------
RFC9497 (draft-irtf-cfrg-voprf-21)
--------------------------------------
Title               : Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups
Publication Date    : December 2023
Author(s)           : A. Davidson, A. Faz-Hernandez, N. Sullivan, C. A. Wood
Category            : INFORMATIONAL
Source              : Crypto Forum Research Group
Stream              : IRTF
Verifying Party     : IRSG