RFC 8032, "Edwards-Curve Digital Signature Algorithm (EdDSA)", January 2017

Errata ID: 6348
Status: Reported
Type: Technical
Publication Format(s) : TEXT
Reported By: David Benjamin
Date Reported: 2020-12-02

Section 3.4 says:

Compute h = H(ENC(R) || ENC(A) || M), and check the group
equation [2^c * S] B = 2^c * R + [2^c * h] A in E.

It should say:

Compute h = H(ENC(R) || ENC(A) || M), and check the group
equation [2^c * S] B = [2^c] R + [2^c * h] A in E.

Notes:

Section 2 uses a separate notation, [n]X, for point multiplication, so this operation should use the brackets.

Report New Errata