RFC 9180, "Hybrid Public Key Encryption", February 2022

Errata ID: 7933
Status: Held for Document Update
Type: Technical
Publication Format(s) : TEXT, PDF, HTML
Reported By: Raul Siles
Date Reported: 2024-05-12
Held for Document Update by: Nick Sullivan
Date Held: 2025-01-18

Section 5.1 says:

return Context<ROLE>(key, base_nonce, 0, exporter_secret)

The ROLE template parameter is either S or R, depending on the role 
of sender or recipient, respectively. See Section 5.2 for a discussion 
of the key schedule output, including the role-specific Context 
structure and its API.

It should say:

return Context<ROLE>(key, base_nonce, 0, exporter_secret)

The ROLE template parameter is either S or R, depending on the role 
of sender or recipient, respectively. The third field in the 
Context<ROLE> refers to the sequence number, that is initialised with 
a 0 value. See Section 5.2 for a discussion of the key schedule output,
including the role-specific Context structure and its API, and the 
usage of the sequence number.

Notes:

In Section 5.1 the return value of KeySchedule<ROLE> reflects:

return Context<ROLE>(key, base_nonce, 0, exporter_secret)

I'm assuming the "0" value (in the third field of the Context<ROLE>) refers to the sequence number, with an initialisation value of 0, that is mentioned in Section 5.2, but the RFCs does not include details about the meaning of this third field and value.

I suggest to clarify in section 5.1 the meaning of that 0 value and field, and add a reference to section 5.2 with all the details about the sequence number.


Hold for document update.

Errata 7933 clarifies sequence initialization in KeySchedule<ROLE>, improving implementer understanding of sequence usage. While low impact, this clarification prevents misunderstandings and supports accurate usage. - CFRG co-chair

Report New Errata