[CFRG] [Technical Errata Reported] RFC8439 (7880)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 03 April 2024 11:23 UTC

To: ynir.ietf@gmail.com, agl@google.com, irsg@irtf.org, cfrg@irtf.org
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: v@njh.eu, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240403112336.1D8B04C290@rfcpa.amsl.com>
Date: Wed, 03 Apr 2024 04:23:36 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/XPHUjFaPPVIwVABmGAMkIvccBRw>
Subject: [CFRG] [Technical Errata Reported] RFC8439 (7880)
Precedence: list

The following errata report has been submitted for RFC8439,
"ChaCha20 and Poly1305 for IETF Protocols".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7880

--------------------------------------
Type: Technical
Reported by: Volker Diels-Grabsch <v@njh.eu>

Section: 2.4.1

Original Text
-------------
encrypted_message |= (block^key_stream)[0..len(plaintext)%64]


Corrected Text
--------------
encrypted_message |= (block^key_stream)[0..(len(plaintext)%64)-1]

Notes
-----
If the plaintext size is not a multiple of 64 bytes, there is an off-by-one error in appending the final block of the encrypted message. In the original version, the encrypted message would always be one byte larger than the plaintext.

The corrected version ensures that the encrypted message size is always equal to the plaintext size.

For completeness: If the plaintext size is a multiple of 64 bytes, the second part of the code is skipped. Hence, this off-by-one error is not triggered in that specific case.

(Non-)relation to correction 5989: The "original text", as quoted here, assumes that correction 5989 has already been applied. Correction 5989 deals with a different issue of this line of code, namely, the replacement of "+=" by "|=". This is completely orthogonal to the off-by-one error described here.

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it 
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC8439 (draft-nir-cfrg-rfc7539bis-04)
--------------------------------------
Title               : ChaCha20 and Poly1305 for IETF Protocols
Publication Date    : June 2018
Author(s)           : Y. Nir, A. Langley
Category            : INFORMATIONAL
Source              : Crypto Forum Research Group
Stream              : IRTF
Verifying Party     : IRSG

[CFRG] [Technical Errata Reported] RFC8439 (7880) RFC Errata System