RFC 8391, "XMSS: eXtended Merkle Signature Scheme", May 2018

Errata ID: 7420
Status: Rejected
Type: Technical
Publication Format(s) : TEXT
Reported By: Rafael Misoczki
Date Reported: 2023-04-11
Rejected by: Nick Sullivan
Date Rejected: 2026-01-28

Section 4.2.2 says:

// Generate reduced XMSS private keys
     ADRS = toByte(0, 32);
     for ( layer = 0; layer < d; layer++ ) {
        ADRS.setLayerAddress(layer);
        for ( tree = 0; tree <
              (1 << ((d - 1 - layer) * (h / d)));
              tree++ ) {
           ADRS.setTreeAddress(tree);
           for ( i = 0; i < 2^(h / d); i++ ) {
             wots_sk[i] = WOTS_genSK();
           }
           setXMSS_SK(SK_MT, wots_sk, tree, layer);
        }
     }

It should say:

// Generate reduced XMSS private keys
     ADRS = toByte(0, 32);
     for ( layer = 0; layer < d; layer++ ) {
        ADRS.setLayerAddress(layer);
        for ( tree = 0; tree <
              (1 << ((d - 1 - layer) * (h / d)));
              tree++ ) {
           ADRS.setTreeAddress(tree);
           for ( i = 0; i < 2^(h / d); i++ ) {
             wots_sk[i] = WOTS_genSK();
           }
           setXMSS_SK(SK_MT, wots_sk, tree, layer, ADRS);
        }
     }

Notes:

The ADRS variable is created and configured (layer address and tree address fields set) but it is not used anywhere in the for-loop.

It would be more precise if the setXMSS_SK function receives the ADRS variable so that implementers understand that both layer address and tree address fields must be set as defined in this for-loop in order to generate the correct XMSS private key in each iteration of this loop.
--VERIFIER NOTES--
The erratum proposes adding an ADRS parameter to setXMSS_SK, but this function is an abstract storage helper with no defined signature in the RFC. The document does not mandate a specific private-key encoding, so changing an undefined function's parameters is not appropriate for errata.

Report New Errata