RFC 9497, "Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups", December 2023

Errata ID: 7925
Status: Reported
Type: Technical
Publication Format(s) : TEXT
Reported By: Stefan Santesson
Date Reported: 2024-05-07

Section 4.3 says:

HashToScalar():  Use hash_to_field from [RFC9380] using L = 48,
         expand_message_xmd with SHA-256, DST = "HashToScalar-" ||
         contextString, and a prime modulus equal to Group.Order().

It should say:

HashToScalar():  Compute uniform_bytes using expand_message =
         expand_message_xmd, DST = "HashToScalar-" || contextString, and
         an output length of 48 bytes, interpret uniform_bytes as a
         384-bit integer in little-endian order, and reduce the integer
         modulo Group.Order().

Notes:

It is incorrect to refer to the hash_to_filed operation of RFC 9380 because the implementation of hash_to_field, as described in section 5.2 of RFC 9380 reduces the result integer mod Field order (not Group order).

7. e_j = OS2IP(tv) mod p

Where p is the characteristic of field F.

The current text imply that the existing hash_to_field implementation for P-256 can be used. But using this will cause a false result due to the mod field order operation.

The a better, and accurate way to describe this is by using the same explanation as for other curve types and specify the use of expand_message_xmd directly modulus Group.Order().

Report New Errata