[TLS] [Technical Errata Reported] RFC8422 (8179)

[RFC Errata System <[e-mail]>]

The following errata report has been submitted for RFC8422,
"Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8179

--------------------------------------
Type: Technical
Reported by: warren.wang <[e-mail]>

Section: 5.4.  Server Key Exc

Original Text
-------------
   The ServerKeyExchange message is extended as follows.

           enum {
               ec_diffie_hellman
           } KeyExchangeAlgorithm;

   o  ec_diffie_hellman: Indicates the ServerKeyExchange message
      contains an ECDH public key.

      select (KeyExchangeAlgorithm) {
          case ec_diffie_hellman:
              ServerECDHParams    params;
              Signature           signed_params;
      } ServerKeyExchange;

.....................................................

        enum {
            ecdsa(3),
            ed25519(7)
            ed448(8)
        } SignatureAlgorithm;
        select (SignatureAlgorithm) {
           case ecdsa:
                digitally-signed struct {
                    opaque sha_hash[sha_size];
                };
           case ed25519,ed448:
                digitally-signed struct {
                    opaque rawdata[rawdata_size];
                };
        } Signature;
      ServerKeyExchange.signed_params.sha_hash
          SHA(ClientHello.random + ServerHello.random +
                                 ServerKeyExchange.params);
      ServerKeyExchange.signed_params.rawdata
          ClientHello.random + ServerHello.random +
                                 ServerKeyExchange.params;

   NOTE: SignatureAlgorithm is "rsa" for the ECDHE_RSA key exchange
   algorithm and "anonymous" for ECDH_anon.  These cases are defined in
   TLS.  SignatureAlgorithm is "ecdsa" or "eddsa" for ECDHE_ECDSA.

Corrected Text
--------------
The extended ServerKeyExchange message seems just for tls version 1.0 and version 1.1, not for 1.2, because tls version 1.2 ServerKeyExchange message format is different from version 1.0 and 1.1. The following is tls version 1.2 ServerKeyExchange message format:

 struct {
 select (KeyExchangeAlgorithm) {
 case dh_anon:
 ServerDHParams params;
 case dhe_dss:
 case dhe_rsa:
 ServerDHParams params;
 digitally-signed struct {
 opaque client_random[32];
 opaque server_random[32];
 ServerDHParams params;
 } signed_params;
 case rsa:
 case dh_dss:
 case dh_rsa:
 struct {} ;
 /* message is omitted for rsa, dh_dss, and dh_rsa */
 /* may be extended, e.g., for ECDH -- see [TLSECC] */
 };
 } ServerKeyExchange;

it does not specify the message format for ECDH_RSA and ECDH_anon, the "NOTE" in original text does not apply to tls version 1.2, because it doesn't have the "Signature" field.

Notes
-----
the ServerKeyExchange for ECDH_RSA and ECDH_anon should be specified for tls version 1.2.

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it 
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC8422 (draft-ietf-tls-rfc4492bis-17)
--------------------------------------
Title               : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier
Publication Date    : August 2018
Author(s)           : Y. Nir, S. Josefsson, M. Pegourie-Gonnard
Category            : PROPOSED STANDARD
Source              : Transport Layer Security
Stream              : IETF
Verifying Party     : IESG