errata logo graphic

Found 21 records.

Status: Verified (21)

RFC5830, "GOST 28147-89: Encryption, Decryption, and Message Authentication Code (MAC) Algorithms", March 2010

Source of RFC: INDEPENDENT

Errata ID: 2094

Status: Verified
Type: Technical

Reported By: V. Dolmatov
Date Reported: 2010-03-23
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 6.1 says:

 - the value of S1 is written into the first bit of N1;

   - the value of S2 is written into the second bit of N1 (etc.);

   - the value of S32 is written into the 32nd bit of N1;

   - the value of S33 is written into the first bit of N2;

   - the value of S34 is written into the 33th bit of N2 (etc.);

   - the value of S64 is written into the 32nd bit of N2.

It should say:

 - the value of S1 is written into the first bit of N1;

   - the value of S2 is written into the second bit of N1 (etc.);

   - the value of S32 is written into the 32nd bit of N1;

   - the value of S33 is written into the first bit of N2;

   - the value of S34 is written into the second bit of N2 (etc.);

   - the value of S64 is written into the 32nd bit of N2.


Errata ID: 2137

Status: Verified
Type: Technical

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 3.1 says:

   Cipher: a set of reversible transformations of the set of possible
   plain texts onto the set of encrypted data, made after certain rules
   and using keys.

It should say:

   Cipher: a set of reversible transformations of the set of possible
   plain texts onto the set of encrypted data carried out by specified 
   rules with the use of keys.

Notes:

"After" does not mean "as a result."


Errata ID: 2140

Status: Verified
Type: Technical

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 5.2 says:

   The fillings of the adders N1 and N2 after 32 working rounds are a
   plain text block.

It should say:

   After 32 working rounds contents of registers N1 and N2 are a plain text block.

Notes:

N1 and N2 aren't adders.


Errata ID: 2144

Status: Verified
Type: Technical

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 6.1 says:

   The filling of N1 and N2 is encrypted in the electronic codebook mode
   according to the requirements of section 5.1.  The resulting
   encrypted filling of N1 and N2 is the second 64-bit block of the
   running key Gc(2); this block is bitwise added modulo 2 in the adder
   CM5 with the first 64-bit block of the plain text Tp(2).  

It should say:

   The filling of N1 and N2 is encrypted in the electronic codebook mode
   according to the requirements of section 5.1.  The resulting
   encrypted filling of N1 and N2 is the second 64-bit block of the
   running key Gc(2); this block is bitwise added modulo 2 in the adder
   CM5 with the second 64-bit block of the plain text Tp(2).  

Errata ID: 2148

Status: Verified
Type: Technical

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.1 says:

   The initial filling of N1 and N2 is encrypted in the electronic
   codebook mode in accordance with the requirements in section 6.1.  If
   resulting encrypted filling N1 and N2 is the first 64-bit block of
   the running key Gc(1)=A(S), then this block is added bitwise modulo 2
   with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ...,
   t64(1)).

It should say:

   The initial filling of N1 and N2 is encrypted in the electronic
   codebook mode in accordance with the requirements in section 6.1.  The
   resulting encrypted filling N1 and N2 is the first 64-bit block of
   the running key Gc(1)=A(S), then this block is added bitwise modulo 2
   in the adder CM5 with the first 64-bit block of plain text Tp(1) = 
   (t1(1), t2(1), ..., t64(1)).

Errata ID: 2152

Status: Verified
Type: Technical

Reported By: Dolmatov V.
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.2 says:

The block of encrypted data Tc(1) makes the initial filling of N1, N2
   for generating the second block of the running key Gc(2).  The block
   Tc(1) is written in N1 and N2 in accordance with the requirements in
   the subsection 6.1, the resulted block Gc(2) is added bitwise modulo
   2 in the adder CM5 to the second block of the encrypted data Tc(2).
   This results in the block of plain text Tc(2).

It should say:

The block of encrypted data Tc(1) makes the initial filling of N1, N2
   for generating the second block of the running key Gc(2).  The block
   Tc(1) is written in N1 and N2 in accordance with the requirements in
   the subsection 6.1. The filling of N1 and N2 is encrypted in the electronic
   codebook mode according to the requirements of section 5.1. The encrypted
   filling of N1 and N2 makes the second 64-bit block Gc(2) which is added
   bitwise modulo 2 in the adder CM5 to the second block of the encrypted data
   Tc(2). This results in the block of plain text Tc(2).

Notes:

One necessary statement was missed in the text.


Errata ID: 2692

Status: Verified
Type: Technical

Reported By: Kirill Gagarski
Date Reported: 2011-01-28
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section Appendix A says:

   The constant C1 is:

      The bit of N6   32 31 30 29 28 27 26 25 24 23 22 21 20 19 18

      The bit value    0  0  0  0  0  0  0  1  0  0  0  0  0  0  0


      The bit of N6   17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

      The bit value    1  0 0  0  0  0  0  0  1 0 0 0 0 0 1 0 0

   The constant C2 is:

      The bit of N6   32 31 30 29 28 27 26 25 24 23 22 21 20 19 18

      The bit value    0  0  0  0  0  0  0  1  0  0  0  0  0  0  0


      The bit of N6   17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

      The bit value    1  0 0  0  0  0  0  0  1 0 0 0 0 0 0 0 1


It should say:

   The constant C1 is:

      The bit of N6   32 31 30 29 28 27 26 25 24 23 22 21 20 19 18

      The bit value    0  0  0  0  0  0  0  1  0  0  0  0  0  0  0


      The bit of N6   17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

      The bit value    1  0 0  0  0  0  0  0  1 0 0 0 0 0 1 0 0

   The constant C2 is:

      The bit of N5   32 31 30 29 28 27 26 25 24 23 22 21 20 19 18

      The bit value    0  0  0  0  0  0  0  1  0  0  0  0  0  0  0


      The bit of N5   17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

      The bit value    1  0 0  0  0  0  0  0  1 0 0 0 0 0 0 0 1


Notes:

C1 is stored in N6 and C2 is stored in N5 (not both in N6)


Errata ID: 2134

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-01-14

Section Abstract says:

   This document is intended to be a source of information about the
   Russian Federal standard for electronic encryption, decryption, and
   message authentication algorithms (GOST 28147-89), which is one of
   the Russian cryptographic standard algorithms called GOST
   algorithms).

It should say:

   This document is intended to be a source of information about the
   Russian Federal standard for electronic encryption, decryption, and
   message authentication algorithms (GOST 28147-89), which is one of
   the Russian cryptographic standard algorithms called GOST
   algorithms.

Errata ID: 2135

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.1 says:

   The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M)
   and encrypted in the cipher feedback mode by bitwise addition modulo
   2 in the adder CM5 with the running key Gc generated in 64-bit
   blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by
                                                                   ___
   the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M.
   The number of bits in the block Tp(M) may be less than 64.

It should say:

   The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M)
   and encrypted in the cipher feedback mode by bitwise addition modulo
   2 in the adder CM5 with the running key Gc generated in 64-bit
   blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by
   the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M.
   The number of bits in the block Tp(M) may be less than 64.


Errata ID: 2136

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 3.1 says:

   Initialisation vector: initial values of plain parameters of a
   cryptographic transformation algorithm.

It should say:

   Initialization vector: initial values of plain parameters of a
   cryptographic transformation algorithm.


Errata ID: 2138

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 4 says:

   When writing a key (W1, W2, ..., W256), Wq = 0..1, q = 1..256, in the
   KDS the value:

   - W1 is written into the 1st bit of the register X0;

   - the value W2 is written into the 2nd bit of the register X0 (etc.);

   - the value W32 is written into the 32nd bit of the register X0;

   - the value W33 is written into the 1st bit of the register X1;

   - the value W34 is written into the 2nd bit of the register X1
     (etc.);

   - the value W64 is written into the 32nd bit of the register X1;

   - the value W65 is written into the 1st bit of the register X2
     (etc.);

   - the value W256 is written into the 32nd bit of the register X7.


It should say:

   When writing a key (W1, W2, ..., W256), Wq = 0..1, q = 1..256, in the
   KDS:

   - the value W1 is written into the 1st bit of the register X0;

   - the value W2 is written into the 2nd bit of the register X0 (etc.);

   - the value W32 is written into the 32nd bit of the register X0;

   - the value W33 is written into the 1st bit of the register X1;

   - the value W34 is written into the 2nd bit of the register X1
     (etc.);

   - the value W64 is written into the 32nd bit of the register X1;

   - the value W65 is written into the 1st bit of the register X2
     (etc.);

   - the value W256 is written into the 32nd bit of the register X7.



Errata ID: 2139

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 5.1 says:

   The plain text to be encrypted is split into 64-bit blocks.  Input of
   a binary data block Tp = (a1(0), a2(0), ... , a31(0), a32(0), b1(0),
   b2(0), ..., b32(0)) into the registers N1 and N2 is done so that the
   value of a1(0) is put into the first bit of N1, the value of a2(0) is
   put into the second bit of N1, etc., and the value of a32(0) is put
   into the 32nd bit of N1.  The value of b1(0) is put into the first
   bit of N2, the value of b2(0) is put into the 2nd bit of N2, etc.,
   and the value of b32(0) is input into the 32nd bit of N2.

It should say:

   The plain text to be encrypted is split into 64-bit blocks.  Input of
   any binary data block Tp = (a1(0), a2(0), ... , a31(0), a32(0), b1(0),
   b2(0), ..., b32(0)) into the registers N1 and N2 is done so that the
   value of a1(0) is put into the first bit of N1, the value of a2(0) is
   put into the second bit of N1, etc., and the value of a32(0) is put
   into the 32nd bit of N1.  The value of b1(0) is put into the first
   bit of N2, the value of b2(0) is put into the 2nd bit of N2, etc.,
   and the value of b32(0) is input into the 32nd bit of N2.


Errata ID: 2141

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 5.2 says:

      A(Tp) is A(a(0), b(0)) = (a(32), b(32)) = Tc.

It should say:

      A(Tp) = A(a(0), b(0)) = (a(32), b(32)) = Tc.


Errata ID: 2145

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.1 says:

   The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M)
   and encrypted in the cipher feedback mode by bitwise addition modulo
   2 in the adder CM5 with the running key Gc generated in 64-bit
   blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by
                                                                   ___
   the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M.
   The number of bits in the block Tp(M) may be less than 64.

It should say:

   The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M)
   and encrypted in the cipher feedback mode by bitwise addition modulo
   2 in the adder CM5 with the running key Gc generated in 64-bit
   blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by
   the length of the plain text, Gc(i) is the i-th 64-bit block, i=1..M.
   The number of bits in the block Tp(M) may be less than 64.


Errata ID: 2146

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.1 says:

   The initial filling of N1 and N2 is encrypted in the electronic
   codebook mode in accordance with the requirements in section 6.1.  If
   resulting encrypted filling N1 and N2 is the first 64-bit block of
   the running key Gc(1)=A(S), then this block is added bitwise modulo 2
   with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ...,
   t64(1)).

It should say:

   The initial filling of N1 and N2 is encrypted in the electronic
   codebook mode in accordance with the requirements in section 5.1.  If
   resulting encrypted filling N1 and N2 is the first 64-bit block of
   the running key Gc(1)=A(S), then this block is added bitwise modulo 2
   with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ...,
   t64(1)).


Errata ID: 2147

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.1 says:

   The filling of N1 and N2 is encrypted in the electronic codebook mode
   in accordance with the requirements in the section 6.1.  The
   encrypted filling of N1 and N2 makes the second 64-bit block of the
   running key Gc(2), this block is added bitwise modulo 2 in the adder
   CM5 to the second block of the plain text Tp(2).

It should say:

   The filling of N1 and N2 is encrypted in the electronic codebook mode
   in accordance with the requirements in the section 5.1.  The
   encrypted filling of N1 and N2 makes the second 64-bit block of the
   running key Gc(2), this block is added bitwise modulo 2 in the adder
   CM5 to the second block of the plain text Tp(2).


Errata ID: 2149

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 7.2 says:

   The initial filling of N1 and N2 (the initialisation vector S) is
   encrypted in the electronic codebook mode in accordance with the
   subsection 6.1.  The encrypted filling of N1, N2 is the first block
   of the running key Gc(1) = A(S), this block is added bitwise modulo 2
   in the adder CM5 with the encrypted data block Tc(1).  This results
   in the first block of plain text Tp(1).

It should say:

   The initial filling of N1 and N2 (the initialisation vector S) is
   encrypted in the electronic codebook mode in accordance with the
   subsection 5.1.  The encrypted filling of N1, N2 is the first block
   of the running key Gc(1) = A(S), this block is added bitwise modulo 2
   in the adder CM5 with the encrypted data block Tc(1).  This results
   in the first block of plain text Tp(1).


Errata ID: 2150

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 8 says:

   - The first block of plain text:

      Tp(1) = (t1(1), t1(2), ..., t64(1)) = (a1(1)[0], a2(1)[0], ...,
              a32(1)[0], b1(1)[0], b2(1)[0], ..., b32(1)[0])

It should say:

   The first block of plain text:

      Tp(1) = (t1(1), t1(2), ..., t64(1)) = (a1(1)[0], a2(1)[0], ...,
              a32(1)[0], b1(1)[0], b2(1)[0], ..., b32(1)[0])


Errata ID: 2151

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 8 says:

   The filling of N1 and N2 is transformed in accordance with the first
   16 rounds of the encryption algorithm in the electronic codebook mode
   (see the subsection 6.1).  In the KDS, there exists the same key that
   is used for encrypting the blocks of plain text Tp(1), Tp(2), ...,
   Tp(M) in the corresponding blocks of encrypted data Tc(1), Tc(2),
   ..., Tc(M).

It should say:

   The filling of N1 and N2 is transformed in accordance with the first
   16 rounds of the encryption algorithm in the electronic codebook mode
   (see the subsection 5.1).  In the KDS, there exists the same key that
   is used for encrypting the blocks of plain text Tp(1), Tp(2), ...,
   Tp(M) in the corresponding blocks of encrypted data Tc(1), Tc(2),
   ..., Tc(M).


Errata ID: 2153

Status: Verified
Type: Editorial

Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 8 says:

   The resulting filling of N1 and N2 is added in the CM5 modulo 2 with
   the third block Tp(3), etc., the last block Tp(M) = (t1(M), t2(M),
   ..., t64(M)), padded if necessary to a complete 64-bit block by
   zeros, is added in CM5 modulo 2 with the filling N1, N2 (a1(M-1)[16],
   a2(M-1)[16], ..., a32(M-1)[16], b1(M-1)[16], b2(M-1)[16], ...,
   b32(M-1)[16]).

It should say:

   The resulting filling of N1 and N2 is added in the CM5 modulo 2 with
   the third block Tp(3), etc., the last block Tp(M) = (t1(M), t2(M),
   ..., t64(M)), padded if necessary to a complete 64-bit block by
   zeros, is added in CM5 modulo 2 with the filling N1, N2 
   (a1(M-1)[16], a2(M-1)[16], ..., a32(M-1)[16], b1(M-1)[16], 
   b2(M-1)[16], ..., b32(M-1)[16]).


Errata ID: 2154

Status: Verified
Type: Editorial

Reported By: Dolmatov V.
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12

Section 8 says:

The encrypted data Tc(1), Tc(2), ..., Tc(M), when arriving, are
   decrypted, out of the resulting plain text blocks Tp(1), Tp(2), ...,
   Tp(M).  The MAC I'(l) is generated as described in the subsection 5.3
   and compared with the MAC I(l) received together with the encrypted
   data from the telecommunication channel or from the computer memory.
   If the MACs are not equal, the resulting plain text blocks Tp(1),
   Tp(2), ..., Tp(M) are considered false.


It should say:

he encrypted data Tc(1), Tc(2), ..., Tc(M), when arriving, are
   decrypted, out of the resulting plain text blocks Tp(1), Tp(2), ...,
   Tp(M).  The MAC I'(l) is generated as described above
   and compared with the MAC I(l) received together with the encrypted
   data from the telecommunication channel or from the computer memory.
   If the MACs are not equal, the resulting plain text blocks Tp(1),
   Tp(2), ..., Tp(M) are considered false.


Notes:

wrong reference to the original text sections


Report New Errata