RFC 7539, "ChaCha20 and Poly1305 for IETF Protocols", May 2015

Note: This RFC has been obsoleted by RFC 8439

Errata ID: 8274
Status: Rejected
Type: Technical
Publication Format(s) : TEXT
Reported By: Alina Obst
Date Reported: 2025-01-30
Rejected by: Nick Sullivan
Date Rejected: 2026-01-28

Section 2.3.2 says:

 ChaCha state with the key setup.

       61707865  3320646e  79622d32  6b206574
       03020100  07060504  0b0a0908  0f0e0d0c
       13121110  17161514  1b1a1918  1f1e1d1c
       00000001  09000000  4a000000  00000000

It should say:

 ChaCha state with the key setup.

       61707865  3320646e  79622d32  6b206574
       03020100  07060504  0b0a0908  0f0e0d0c
       13121110  17161514  1b1a1918  1f1e1d1c
       01000000  09000000  4a000000  00000000

Notes:

Section 2.3 says: "A 32-bit block count parameter, treated as a 32-bit little-endian integer". In Section 2.3.2 the initial block counter is set to 1 which is 00000001 in big-endian hex. So I think, the corresponding entry in the state matrix (index 12) should be 01000000.

Note from CFRG Chair: this change also applies to RFC 8439, which supercedes RFC 7539
--VERIFIER NOTES--
Rejected. The submitter correctly notes the "little-endian" description in Section 2.3, but this refers to parsing bytes into words and serializing words to bytes, not how values appear in the state matrix. The matrix displays 32-bit word values: the block counter is an integer placed into word 12, so value 1 displays as 00000001. If the proposed change were applied, the matrix would show 01000000 (integer 16,777,216), contradicting Block Count = 1. See also EID 6569 on RFC 8439 (similar confusion).

Report New Errata