[CFRG] [Errata Held for Document Update] RFC9497 (8393)

RFC Errata System <rfc-editor@rfc-editor.org> Tue, 27 January 2026 20:47 UTC

To: daxpedda@gmail.com, alex.davidson92@gmail.com, armfazh@cloudflare.com, nicholas.sullivan+ietf@gmail.com, caw@heapingbits.net
From: RFC Errata System <rfc-editor@rfc-editor.org>
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20260127204735.57D37C000CE0@rfcpa.rfc-editor.org>
Date: Tue, 27 Jan 2026 12:47:35 -0800
Message-ID-Hash: MGPNC2JF7E3RTFCA3X4AMWBLR3DCTSRU
CC: irsg@irtf.org, cfrg@irtf.org, rfc-editor@rfc-editor.org
Precedence: list
Subject: [CFRG] [Errata Held for Document Update] RFC9497 (8393)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/T3IzSIbuh_4dLzHBS5zwPxrtblE>

The following errata report has been held for document update 
for RFC9497, "Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8393

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: daxpedda <daxpedda@gmail.com>
Date Reported: 2025-04-25
Held by: Nick Sullivan (IRSG)

Section: 4.7

Original Text
-------------
4.7.1.  Rejection Sampling

   Generate a random byte array with Ns bytes and attempt to map to a
   Scalar by calling DeserializeScalar in constant time.
   ...

4.7.2.  Random Number Generation Using Extra Random Bits

   Generate a random byte array with L = ceil(((3 *
   ceil(log2(G.Order()))) / 2) / 8) bytes, and interpret it as an
   integer; reduce the integer modulo G.Order(), and return the result.

Corrected Text
--------------
4.7.1.  Rejection Sampling

   Generate a random byte array with Ns bytes and attempt to map to a
   Scalar by calling DeserializeScalar and checking for a nonzero Scalar
   in constant time.
   ...

4.7.2.  Random Number Generation Using Extra Random Bits

   Generate a random byte array with L = ceil(((3 *
   ceil(log2(G.Order()))) / 2) / 8) bytes, and interpret it as an
   integer; reduce the integer modulo G.Order() - 1, 1, and return the
   result.

Notes
-----
Section 2.1 states: "Chooses at random a nonzero element
in GF(p)." So RandomScalar() implementations can't return 0.

For rejection sampling I recommend changing DeserializeScalar()
to check for nonzero Scalar and decline those. My suggested
errata is a compromise to keep the change specific.

For "Random Number Generation Using Extra Random Bits" my
suggestion follows FIPS 186-5 A.2.1.

--VERIFIER NOTE--
Held for document update. The underlying issue (RandomScalar
must exclude zero) is valid and addressed by EID 8392, which
fixes the Section 4 range to [1, G.Order()-1]. This erratum's
proposed text for Section 4.7 is unclear ("modulo G.Order() -
1, 1"). For implementers: the correct approach per FIPS 186-5
A.2.1 is (random mod (G.Order()-1)) + 1, producing scalars in
[1, G.Order()-1].

--------------------------------------
RFC9497 (draft-irtf-cfrg-voprf-21)
--------------------------------------
Title               : Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups
Publication Date    : December 2023
Author(s)           : A. Davidson, A. Faz-Hernandez, N. Sullivan, C. A. Wood
Category            : INFORMATIONAL
Source              : Crypto Forum Research Group
Stream              : IRTF
Verifying Party     : IRSG

[CFRG] [Errata Held for Document Update] RFC9497 … RFC Errata System