Re: [Crypto-panel] EXTERNAL: Request for review: The ristretto255 and decaf448 Groups

[Thomas Pornin <[e-mail]>]

Here is my review. In summary, this draft is good and I support its publication as an RFC.
There is always a way to nitpick something, so here are some comments that are purely esthetical/typographical in nature:

Section 2: "a constant-time logical OR" -> this is the only place where
"constant-time" has an hyphen; in other places (e.g. title of section
2.2) it is written as "constant time", with a space. I believe both ways
exist and are valid, but a given document should choose one and use it
consistently.

Section 4.3.1: "an integer s in little-endian representation" -> it might
be clearer to say "an integer s in unsigned little-endian representation",
to highlight the fact that there is no sign bit.
-> same remark for section 5.3.1

Section 4.3.2: "the 32-byte little-endian encoding of s" -> maybe expand
that into "the 32-byte little-endian encoding of the canonical
representation of the field element s as an integer in the 0 to p-1
range". People might otherwise be tempted to cut corners and skip the
final reduction or something.
-> same remark for section 5.3.2

Section 4.3.4 (step 1): "in little-endian representation" -> "in unsigned
little-endian representation" (same as in section 4.3.1)
-> same remark for section 5.3.4

Section 9: "Riad S.  Wahby" -> here there are two spaces between "S."
and "Wahby" (at least in the ASCII text representation), which I think
is not typographically correct, because the dot is not a sentence
ending; it should read as "Riad S. Wahby". I suppose that the text
representation is automatically generated from some Markdown or XML
input, and that the unfortunate extra space is added in that process.

Apart from that, everything is fine.

Note: I have implemented ristretto255, and can thus positively confirm that all formulas and test vectors for ristretto255 are correct. I have NOT implemented decaf448, though, so I do not formally confirm correctness of that one; however, the formulas make sense.

Thomas

From: Crypto-panel <[e-mail]> on behalf of Thomas Pornin <thomas.pornin=[e-mail]>
Date: Thursday, November 17, 2022 at 12:44
To: Alexey Melnikov <[e-mail]>, [e-mail] <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: Re: [Crypto-panel] EXTERNAL: Request for review: The ristretto255 and decaf448 Groups
I can review it.

Thomas

From: Crypto-panel <[e-mail]> on behalf of Alexey Melnikov <[e-mail]>
Date: Thursday, November 17, 2022 at 12:41
To: [e-mail] <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: EXTERNAL: [Crypto-panel] Request for review: The ristretto255 and decaf448 Groups
Dear Crypto Panel Experts,

The chairs would like to ask the Crypto Panel to provide a review to
help move "The ristretto255 and decaf448 Groups"
draft-irtf-cfrg-ristretto255-decaf448-04
(https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-irtf-cfrg-ristretto255-decaf448%2F&amp;data=05%7C01%7Cthomas.pornin%40nccgroup.com%7C4acab1e2451a4dcce10908dac8c2e11a%7Ca41111be486b45f68bd0ee01a62f368e%7C0%7C0%7C638043036626907309%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=4whBipLwnWoH7gvpOhDbGyEhM0Xjv2jpxItbZ%2F%2BeZaY%3D&amp;reserved=0<https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-irtf-cfrg-ristretto255-decaf448%2F&data=05%7C01%7Cthomas.pornin%40nccgroup.com%7C0da09539046f4ac936ee08dac8c36714%7Ca41111be486b45f68bd0ee01a62f368e%7C0%7C0%7C638043038847574165%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=T7YtpoPXEXIjdC0PWOhJTcw4mmBz5rb1oYSZ%2BZX5Q9c%3D&reserved=0>)
document forward.

Any volunteers?

Best Regards,
Alexey (on behalf of the CFRG Chairs)

_______________________________________________
Crypto-panel mailing list
[e-mail]
https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcrypto-panel&amp;data=05%7C01%7Cthomas.pornin%40nccgroup.com%7C4acab1e2451a4dcce10908dac8c2e11a%7Ca41111be486b45f68bd0ee01a62f368e%7C0%7C0%7C638043036626907309%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=KJoEOjMe1B8HkkzMaBwGRDnjLtCXhb8p%2FWTlw8%2BKCBo%3D&amp;reserved=0<https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcrypto-panel&data=05%7C01%7Cthomas.pornin%40nccgroup.com%7C0da09539046f4ac936ee08dac8c36714%7Ca41111be486b45f68bd0ee01a62f368e%7C0%7C0%7C638043038847574165%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2FddzH92kEa%2FuncHvBBL4s2DjsD5SW3noRik0LHshJOI%3D&reserved=0>