Re: [CFRG] [irsg] [Technical Errata Reported] RFC7748 (7879)

[Rebecca VanRheenen <[e-mail]>]

Hi Colin and others,

We note that this erratum reports the same issue as was reported in errata report 5651 (https://www.rfc-editor.org/errata/eid5651). 

If no objections, we will delete this report. If needed, we can also add additional notes to errata report 5651. Just let us know.

Thank you,
RFC Editor/rv



> On Apr 3, 2024, at 3:19 PM, Colin Perkins <[e-mail]> wrote:
> 
> Hi,
> 
> To confirm: the outcome here should be to reject the errata, with a note that both the current text in the RFC and the errata are correct, so no update is needed?
> 
> Colin
> 
> 
> On 2 Apr 2024, at 22:42, Mike Hamburg wrote:
> 
> Hello Nawras,
> 
> Thanks for reporting this. The calculation can be done with either AA setting “a24” = (A-2)/4, or with BB setting “a24” = (A+2)/4.  Both calculations appear in the literature.  We happened to follow the Curve25519 paper instead of the original Montgomery paper when making the RFC.
> 
> See eg https://crypto.stackexchange.com/questions/67942/difference-on-montgomery-curve-equation-between-efd-and-rfc7748
> 
> Regards,
> — Mike
> 
>> On Apr 2, 2024, at 16:22, RFC Errata System <[e-mail]> wrote:
>> 
>> The following errata report has been submitted for RFC7748,
>> "Elliptic Curves for Security".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid7879
>> 
>> --------------------------------------
>> Type: Technical
>> Reported by: Nawras Hussein Sabbry <[e-mail]>
>> 
>> Section: 5
>> 
>> Original Text
>> -------------
>> z_2 = E * (AA + a24 * E)
>> 
>> Corrected Text
>> --------------
>> z_2 = E * (BB + a24 * E)
>> 
>> Notes
>> -----
>> In the for loop on page 8, the variable AA should be replaced with BB in Z_2. This modification is necessary because the mathematical formula for point doubling on the Montgomery curve according to (https://en.wikipedia.org/wiki/Montgomery_curve#Montgomery_arithmetic) indicates that Z2n (equivalent to Z_2 in this case) is calculated as follows: Z2n = 4XnZn((Xn-Zn)^2 + ((A+2)/4)(4XnZn)). It is observed in this equation that the operation in the (Xn-Zn)^2 part involves subtraction similar to the variable B, while the operation in the variable A involves addition. Considering this discrepancy, it is suggested to substitute AA with BB for correctness.
>> 
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". (If it is spam, it
>> will be removed shortly by the RFC Production Center.) Please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party  
>> will log in to change the status and edit the report, if necessary.
>> 
>> --------------------------------------
>> RFC7748 (draft-irtf-cfrg-curves-11)
>> --------------------------------------
>> Title               : Elliptic Curves for Security
>> Publication Date    : January 2016
>> Author(s)           : A. Langley, M. Hamburg, S. Turner
>> Category            : INFORMATIONAL
>> Source              : Crypto Forum Research Group
>> Stream              : IRTF
>> Verifying Party     : IRSG