Re: [Cfrg] [Errata Verified] RFC8032 (5519)

Thanks, Dimity.

Can someone else in the RG double-check to confirm? Once that’s done, I can work with the RFC Editor to get correct fix recorded.

Colin

> On 23 Jul 2020, at 13:43, Dmitry Khovratovich <khovratovich@gmail.com> wrote:
> 
> It seems there is another typo in 5.1.7, as public key and its encoding are confused:
> 
> Decode the first half as a
>        point R, and the second half as an integer S, in the range
>        0 <= s < L.  Decode the public key A as point A'.  If any of the
>        decodings fail (including S being out of range), the signature is
>        invalid.
> 
>    2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
>        64-octet digest as a little-endian integer k.
> 
>    3.  Check the group equation [8][S]B = [8]R + [8][k]A'.  It's
>        sufficient, but not required, to instead check [S]B = R + [k]A'.
> 
> 
> 
> 
> Should be 
> 
> Decode the first half R as a
>        point R`, and the second half as an integer S, in the range
>        0 <= S < L.  Decode the public key A as point A'.  If any of the
>        decodings fail (including S being out of range), the signature is
>        invalid.
> 
>    2.  Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the
>        64-octet digest as a little-endian integer k.
> 
>    3.  Check the group equation [8][S]B = [8]R` + [8][k]A'.  It's
>        sufficient, but not required, to instead check [S]B = R` + [k]A'.
> 
> 
> 
> 
> Dmitry Khovratovich
> 
> On Tue, Apr 9, 2019 at 6:32 PM RFC Errata System <rfc-editor@rfc-editor.org <mailto:rfc-editor@rfc-editor.org>> wrote:
> The following errata report has been verified for RFC8032,
> "Edwards-Curve Digital Signature Algorithm (EdDSA)". 
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5519 <http://www.rfc-editor.org/errata/eid5519>
> 
> --------------------------------------
> Status: Verified
> Type: Editorial
> 
> Reported by: Susumu Endoh <sus-e@ubiquitous-ai.com <mailto:sus-e@ubiquitous-ai.com>>
> Date Reported: 2018-10-10
> Verified by: Colin Perkins (IRSG)
> 
> Section: 5.1.7
> 
> Original Text
> -------------
> Decode the first half as a point R, and the second half as an integer S,
> in the range 0 <= s < L.
> 
> 
> Corrected Text
> --------------
> Decode the first half as a point R, and the second half as an integer S,
> in the range 0 <= S < L.
> 
> 
> Notes
> -----
> original document expression is ' 0 <= s < L', but it must be '0 <= S < L'. upper/lower case problem.
> 
> --------------------------------------
> RFC8032 (draft-irtf-cfrg-eddsa-08)
> --------------------------------------
> Title               : Edwards-Curve Digital Signature Algorithm (EdDSA)
> Publication Date    : January 2017
> Author(s)           : S. Josefsson, I. Liusvaara
> Category            : INFORMATIONAL
> Source              : Crypto Forum Research Group
> Area                : N/A
> Stream              : IRTF
> Verifying Party     : IRSG
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org <mailto:Cfrg@irtf.org>
> https://www.irtf.org/mailman/listinfo/cfrg <https://www.irtf.org/mailman/listinfo/cfrg>
> 
> 
> -- 
> Best regards,
> Dmitry Khovratovich
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
Colin Perkins
https://csperkins.org/