RFC 8439, "ChaCha20 and Poly1305 for IETF Protocols", June 2018

Errata ID: 6989
Status: Rejected
Type: Technical
Publication Format(s) : TEXT
Reported By: Mike Markowitz
Date Reported: 2022-06-10
Rejected by: Nick Sullivan
Date Rejected: 2025-10-20

Section 2.8.2 says:

Poly1305 r =  455e9a4057ab6080f47b42c052bac7b

It should say:

Poly1305 r = 8455e9a4057ab6080f47b42c052bac7b

Notes:

fist nibble of r appears to be missing
--VERIFIER NOTES--
r in Section 2.8.2 is the clamped 128-bit little-endian integer derived from the first 16 bytes of the Poly1305 one-time key. Clamping clears the top bits (see Section 2.5.1), so the big-endian hex begins 0x0455..., and when printed as a number the leading zero nibble may be omitted, yielding 455e9a4057ab6080f47b42c052bac7b as shown in the RFC. The 0x8455e9a4 value visible in the preceding table is a pre-clamp ChaCha20 block word, not r itself. This report conflates the pre-clamp word with the post-clamp r.

Refs: RFC 8439 Section 2.5.1 and Section 2.8.2: http://www.rfc-editor.org/rfc/rfc8439.html

Report New Errata