Re: [CFRG] [irsg] [Technical Errata Reported] RFC7748 (7879)

[Colin Perkins <[e-mail]>]

Hi,

To confirm: the outcome here should be to reject the errata, with a note 
that both the current text in the RFC and the errata are correct, so no 
update is needed?

Colin


On 2 Apr 2024, at 22:42, Mike Hamburg wrote:

> Hello Nawras,
>
> Thanks for reporting this. The calculation can be done with either AA 
> setting “a24” = (A-2)/4, or with BB setting “a24” = (A+2)/4.  
> Both calculations appear in the literature.  We happened to follow the 
> Curve25519 paper instead of the original Montgomery paper when making 
> the RFC.
>
> See eg 
> https://crypto.stackexchange.com/questions/67942/difference-on-montgomery-curve-equation-between-efd-and-rfc7748
>
> Regards,
> — Mike
>
>> On Apr 2, 2024, at 16:22, RFC Errata System 
>> <[e-mail]> wrote:
>>
>> The following errata report has been submitted for RFC7748,
>> "Elliptic Curves for Security".
>>
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid7879
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: Nawras Hussein Sabbry <[e-mail]>
>>
>> Section: 5
>>
>> Original Text
>> -------------
>> z_2 = E * (AA + a24 * E)
>>
>> Corrected Text
>> --------------
>> z_2 = E * (BB + a24 * E)
>>
>> Notes
>> -----
>> In the for loop on page 8, the variable AA should be replaced with BB 
>> in Z_2. This modification is necessary because the mathematical 
>> formula for point doubling on the Montgomery curve according to 
>> (https://en.wikipedia.org/wiki/Montgomery_curve#Montgomery_arithmetic) 
>> indicates that Z2n (equivalent to Z_2 in this case) is calculated as 
>> follows: Z2n = 4XnZn((Xn-Zn)^2 + ((A+2)/4)(4XnZn)). It is observed in 
>> this equation that the operation in the (Xn-Zn)^2 part involves 
>> subtraction similar to the variable B, while the operation in the 
>> variable A involves addition. Considering this discrepancy, it is 
>> suggested to substitute AA with BB for correctness.
>>
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". (If it is spam, it
>> will be removed shortly by the RFC Production Center.) Please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party
>> will log in to change the status and edit the report, if necessary.
>>
>> --------------------------------------
>> RFC7748 (draft-irtf-cfrg-curves-11)
>> --------------------------------------
>> Title               : Elliptic Curves for Security
>> Publication Date    : January 2016
>> Author(s)           : A. Langley, M. Hamburg, S. Turner
>> Category            : INFORMATIONAL
>> Source              : Crypto Forum Research Group
>> Stream              : IRTF
>> Verifying Party     : IRSG