Re: [CFRG] Handling the errata for RFC 7748

Dear CFRG,

I support this decision.

Last Monday, we got the notification that our paper "A Coq proof of the
correctness of X25519 in TweetNaCl" [1]
got accepted. This paper contains two formally mechanized proofs:
- TweetNaCl is correct with respect to the RFC.
- and more importantly that *X25519 in the RFC is correct with respect
to the original paper by Bernstein* [2].

Regards.

[1]: https://benoit.viguier.nl/files/tweetverif.pdf
<https://benoit.viguier.nl/files/tweetverif.pdf>
[2]: https://cr.yp.to/ecdh/curve25519-20060209.pdf
<https://cr.yp.to/ecdh/curve25519-20060209.pdf>

On 12/10/20 7:50 AM, Stanislav V. Smyshlyaev wrote:
> Dear CFRG,
>
> There are three reported errata for RFC 7748:
> https://www.rfc-editor.org/errata/eid5568
> <https://www.rfc-editor.org/errata/eid5568>
> https://www.rfc-editor.org/errata/eid5651
> <https://www.rfc-editor.org/errata/eid5651>
> https://www.rfc-editor.org/errata/eid5028
> <https://www.rfc-editor.org/errata/eid5028>
>
> The third one (5028) is an editorial one, I am sure that it improves
> clarity of the text, therefore, I support it without doubt.
>
> The first one (5568) is a technical one, with a proposal to change one
> bit of the input u-coordinate in the hexadecimal representation (to
> make it "consistent" with the base 10 representation). However,
> the author of 5568 has probably missed that implementations of x25519
> should "mask" that bit after taking a u-coordinate as an input -
> therefore, the existing text of RFC does not have any errors there.
> This is exactly the result of unclear text that is addressed in the
> abovementioned third erratum (5028).Therefore, I would propose to
> reject the erratum.
>
> The second one (5651) notes that the algorithm description has a
> mistake in the description (for calculation of z_2). After
> implementing the described algorithm myself (with the MAGMA package)
> I've obtained the expected numbers. I suspect that the RFC text is OK,
> –therefore I would propose to reject the erratum.
>
> Therefore, I'm planning to approve the third one (5028) and reject the
> other two errata (5568 and 5651).
>
> Regards,
> Stanislav
>
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
Kind regards,

Benoît Viguier
Software Engineer - PhD Student | Cryptography & Formal Methods
Radboud University | Mercator 1, Toernooiveld 212
6525 EC Nijmegen, the Netherlands | www.viguier.nl