Re: [CFRG] [irsg] [Technical Errata Reported] RFC7748 (7879)

[Colin Perkins <[e-mail]>]

Hi RFC Editor, all,

Thanks – I hadn't noticed the duplicate, but I'm pleased we settled 
on the same resolution.

I would suggest that rather than delete the errata, it be marked as 
Rejected with a note that it's a duplicate of errata report 5651 (the 
discussion in the mailing list archive will then be meaningful; we 
should keep the history).

Thanks,
Colin



On 5 Apr 2024, at 20:36, Rebecca VanRheenen wrote:

> Hi Colin and others,
>
> We note that this erratum reports the same issue as was reported in 
> errata report 5651 (https://www.rfc-editor.org/errata/eid5651).
>
> If no objections, we will delete this report. If needed, we can also 
> add additional notes to errata report 5651. Just let us know.
>
> Thank you,
> RFC Editor/rv
>
>
>
>> On Apr 3, 2024, at 3:19 PM, Colin Perkins <[e-mail]> wrote:
>>
>> Hi,
>>
>> To confirm: the outcome here should be to reject the errata, with a 
>> note that both the current text in the RFC and the errata are 
>> correct, so no update is needed?
>>
>> Colin
>>
>>
>> On 2 Apr 2024, at 22:42, Mike Hamburg wrote:
>>
>> Hello Nawras,
>>
>> Thanks for reporting this. The calculation can be done with either AA 
>> setting “a24” = (A-2)/4, or with BB setting “a24” = (A+2)/4.  
>> Both calculations appear in the literature.  We happened to follow 
>> the Curve25519 paper instead of the original Montgomery paper when 
>> making the RFC.
>>
>> See eg 
>> https://crypto.stackexchange.com/questions/67942/difference-on-montgomery-curve-equation-between-efd-and-rfc7748
>>
>> Regards,
>> — Mike
>>
>>> On Apr 2, 2024, at 16:22, RFC Errata System 
>>> <[e-mail]> wrote:
>>>
>>> The following errata report has been submitted for RFC7748,
>>> "Elliptic Curves for Security".
>>>
>>> --------------------------------------
>>> You may review the report below and at:
>>> https://www.rfc-editor.org/errata/eid7879
>>>
>>> --------------------------------------
>>> Type: Technical
>>> Reported by: Nawras Hussein Sabbry <[e-mail]>
>>>
>>> Section: 5
>>>
>>> Original Text
>>> -------------
>>> z_2 = E * (AA + a24 * E)
>>>
>>> Corrected Text
>>> --------------
>>> z_2 = E * (BB + a24 * E)
>>>
>>> Notes
>>> -----
>>> In the for loop on page 8, the variable AA should be replaced with 
>>> BB in Z_2. This modification is necessary because the mathematical 
>>> formula for point doubling on the Montgomery curve according to 
>>> (https://en.wikipedia.org/wiki/Montgomery_curve#Montgomery_arithmetic) 
>>> indicates that Z2n (equivalent to Z_2 in this case) is calculated as 
>>> follows: Z2n = 4XnZn((Xn-Zn)^2 + ((A+2)/4)(4XnZn)). It is observed 
>>> in this equation that the operation in the (Xn-Zn)^2 part involves 
>>> subtraction similar to the variable B, while the operation in the 
>>> variable A involves addition. Considering this discrepancy, it is 
>>> suggested to substitute AA with BB for correctness.
>>>
>>> Instructions:
>>> -------------
>>> This erratum is currently posted as "Reported". (If it is spam, it
>>> will be removed shortly by the RFC Production Center.) Please
>>> use "Reply All" to discuss whether it should be verified or
>>> rejected. When a decision is reached, the verifying party
>>> will log in to change the status and edit the report, if necessary.
>>>
>>> --------------------------------------
>>> RFC7748 (draft-irtf-cfrg-curves-11)
>>> --------------------------------------
>>> Title               : Elliptic Curves for Security
>>> Publication Date    : January 2016
>>> Author(s)           : A. Langley, M. Hamburg, S. Turner
>>> Category            : INFORMATIONAL
>>> Source              : Crypto Forum Research Group
>>> Stream              : IRTF
>>> Verifying Party     : IRSG