RFC Errata
Found 21 records.
Status: Verified (21)
RFC 5830, "GOST 28147-89: Encryption, Decryption, and Message Authentication Code (MAC) Algorithms", March 2010
Note: This RFC has been updated by RFC 8891
Source of RFC: INDEPENDENT
Errata ID: 2094
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: V. Dolmatov
Date Reported: 2010-03-23
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 6.1 says:
- the value of S1 is written into the first bit of N1; - the value of S2 is written into the second bit of N1 (etc.); - the value of S32 is written into the 32nd bit of N1; - the value of S33 is written into the first bit of N2; - the value of S34 is written into the 33th bit of N2 (etc.); - the value of S64 is written into the 32nd bit of N2.
It should say:
- the value of S1 is written into the first bit of N1; - the value of S2 is written into the second bit of N1 (etc.); - the value of S32 is written into the 32nd bit of N1; - the value of S33 is written into the first bit of N2; - the value of S34 is written into the second bit of N2 (etc.); - the value of S64 is written into the 32nd bit of N2.
Errata ID: 2137
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 3.1 says:
Cipher: a set of reversible transformations of the set of possible plain texts onto the set of encrypted data, made after certain rules and using keys.
It should say:
Cipher: a set of reversible transformations of the set of possible plain texts onto the set of encrypted data carried out by specified rules with the use of keys.
Notes:
"After" does not mean "as a result."
Errata ID: 2140
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 5.2 says:
The fillings of the adders N1 and N2 after 32 working rounds are a plain text block.
It should say:
After 32 working rounds contents of registers N1 and N2 are a plain text block.
Notes:
N1 and N2 aren't adders.
Errata ID: 2144
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 6.1 says:
The filling of N1 and N2 is encrypted in the electronic codebook mode according to the requirements of section 5.1. The resulting encrypted filling of N1 and N2 is the second 64-bit block of the running key Gc(2); this block is bitwise added modulo 2 in the adder CM5 with the first 64-bit block of the plain text Tp(2).
It should say:
The filling of N1 and N2 is encrypted in the electronic codebook mode according to the requirements of section 5.1. The resulting encrypted filling of N1 and N2 is the second 64-bit block of the running key Gc(2); this block is bitwise added modulo 2 in the adder CM5 with the second 64-bit block of the plain text Tp(2).
Errata ID: 2148
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.1 says:
The initial filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in section 6.1. If resulting encrypted filling N1 and N2 is the first 64-bit block of the running key Gc(1)=A(S), then this block is added bitwise modulo 2 with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ..., t64(1)).
It should say:
The initial filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in section 6.1. The resulting encrypted filling N1 and N2 is the first 64-bit block of the running key Gc(1)=A(S), then this block is added bitwise modulo 2 in the adder CM5 with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ..., t64(1)).
Errata ID: 2152
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: Dolmatov V.
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.2 says:
The block of encrypted data Tc(1) makes the initial filling of N1, N2 for generating the second block of the running key Gc(2). The block Tc(1) is written in N1 and N2 in accordance with the requirements in the subsection 6.1, the resulted block Gc(2) is added bitwise modulo 2 in the adder CM5 to the second block of the encrypted data Tc(2). This results in the block of plain text Tc(2).
It should say:
The block of encrypted data Tc(1) makes the initial filling of N1, N2 for generating the second block of the running key Gc(2). The block Tc(1) is written in N1 and N2 in accordance with the requirements in the subsection 6.1. The filling of N1 and N2 is encrypted in the electronic codebook mode according to the requirements of section 5.1. The encrypted filling of N1 and N2 makes the second 64-bit block Gc(2) which is added bitwise modulo 2 in the adder CM5 to the second block of the encrypted data Tc(2). This results in the block of plain text Tc(2).
Notes:
One necessary statement was missed in the text.
Errata ID: 2692
Status: Verified
Type: Technical
Publication Format(s) : TEXT
Reported By: Kirill Gagarski
Date Reported: 2011-01-28
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section Appendix A says:
The constant C1 is:
The bit of N6 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18
The bit value 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0
The bit of N6 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
The bit value 1 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0
The constant C2 is:
The bit of N6 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18
The bit value 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0
The bit of N6 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
The bit value 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1
It should say:
The constant C1 is:
The bit of N6 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18
The bit value 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0
The bit of N6 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
The bit value 1 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0
The constant C2 is:
The bit of N5 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18
The bit value 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0
The bit of N5 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
The bit value 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1
Notes:
C1 is stored in N6 and C2 is stored in N5 (not both in N6)
Errata ID: 2134
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-01-14
Section Abstract says:
This document is intended to be a source of information about the Russian Federal standard for electronic encryption, decryption, and message authentication algorithms (GOST 28147-89), which is one of the Russian cryptographic standard algorithms called GOST algorithms).
It should say:
This document is intended to be a source of information about the Russian Federal standard for electronic encryption, decryption, and message authentication algorithms (GOST 28147-89), which is one of the Russian cryptographic standard algorithms called GOST algorithms.
Errata ID: 2135
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.1 says:
The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M)
and encrypted in the cipher feedback mode by bitwise addition modulo
2 in the adder CM5 with the running key Gc generated in 64-bit
blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by
___
the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M.
The number of bits in the block Tp(M) may be less than 64.
It should say:
The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M) and encrypted in the cipher feedback mode by bitwise addition modulo 2 in the adder CM5 with the running key Gc generated in 64-bit blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M. The number of bits in the block Tp(M) may be less than 64.
Errata ID: 2136
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 3.1 says:
Initialisation vector: initial values of plain parameters of a cryptographic transformation algorithm.
It should say:
Initialization vector: initial values of plain parameters of a cryptographic transformation algorithm.
Errata ID: 2138
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 4 says:
When writing a key (W1, W2, ..., W256), Wq = 0..1, q = 1..256, in the
KDS the value:
- W1 is written into the 1st bit of the register X0;
- the value W2 is written into the 2nd bit of the register X0 (etc.);
- the value W32 is written into the 32nd bit of the register X0;
- the value W33 is written into the 1st bit of the register X1;
- the value W34 is written into the 2nd bit of the register X1
(etc.);
- the value W64 is written into the 32nd bit of the register X1;
- the value W65 is written into the 1st bit of the register X2
(etc.);
- the value W256 is written into the 32nd bit of the register X7.
It should say:
When writing a key (W1, W2, ..., W256), Wq = 0..1, q = 1..256, in the
KDS:
- the value W1 is written into the 1st bit of the register X0;
- the value W2 is written into the 2nd bit of the register X0 (etc.);
- the value W32 is written into the 32nd bit of the register X0;
- the value W33 is written into the 1st bit of the register X1;
- the value W34 is written into the 2nd bit of the register X1
(etc.);
- the value W64 is written into the 32nd bit of the register X1;
- the value W65 is written into the 1st bit of the register X2
(etc.);
- the value W256 is written into the 32nd bit of the register X7.
Errata ID: 2139
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 5.1 says:
The plain text to be encrypted is split into 64-bit blocks. Input of a binary data block Tp = (a1(0), a2(0), ... , a31(0), a32(0), b1(0), b2(0), ..., b32(0)) into the registers N1 and N2 is done so that the value of a1(0) is put into the first bit of N1, the value of a2(0) is put into the second bit of N1, etc., and the value of a32(0) is put into the 32nd bit of N1. The value of b1(0) is put into the first bit of N2, the value of b2(0) is put into the 2nd bit of N2, etc., and the value of b32(0) is input into the 32nd bit of N2.
It should say:
The plain text to be encrypted is split into 64-bit blocks. Input of any binary data block Tp = (a1(0), a2(0), ... , a31(0), a32(0), b1(0), b2(0), ..., b32(0)) into the registers N1 and N2 is done so that the value of a1(0) is put into the first bit of N1, the value of a2(0) is put into the second bit of N1, etc., and the value of a32(0) is put into the 32nd bit of N1. The value of b1(0) is put into the first bit of N2, the value of b2(0) is put into the 2nd bit of N2, etc., and the value of b32(0) is input into the 32nd bit of N2.
Errata ID: 2141
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-08
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 5.2 says:
A(Tp) is A(a(0), b(0)) = (a(32), b(32)) = Tc.
It should say:
A(Tp) = A(a(0), b(0)) = (a(32), b(32)) = Tc.
Errata ID: 2145
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.1 says:
The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M)
and encrypted in the cipher feedback mode by bitwise addition modulo
2 in the adder CM5 with the running key Gc generated in 64-bit
blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by
___
the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M.
The number of bits in the block Tp(M) may be less than 64.
It should say:
The plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M) and encrypted in the cipher feedback mode by bitwise addition modulo 2 in the adder CM5 with the running key Gc generated in 64-bit blocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by the length of the plain text, Gc(i) is the i-th 64-bit block, i=1..M. The number of bits in the block Tp(M) may be less than 64.
Errata ID: 2146
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.1 says:
The initial filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in section 6.1. If resulting encrypted filling N1 and N2 is the first 64-bit block of the running key Gc(1)=A(S), then this block is added bitwise modulo 2 with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ..., t64(1)).
It should say:
The initial filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in section 5.1. If resulting encrypted filling N1 and N2 is the first 64-bit block of the running key Gc(1)=A(S), then this block is added bitwise modulo 2 with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ..., t64(1)).
Errata ID: 2147
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.1 says:
The filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in the section 6.1. The encrypted filling of N1 and N2 makes the second 64-bit block of the running key Gc(2), this block is added bitwise modulo 2 in the adder CM5 to the second block of the plain text Tp(2).
It should say:
The filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in the section 5.1. The encrypted filling of N1 and N2 makes the second 64-bit block of the running key Gc(2), this block is added bitwise modulo 2 in the adder CM5 to the second block of the plain text Tp(2).
Errata ID: 2149
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 7.2 says:
The initial filling of N1 and N2 (the initialisation vector S) is encrypted in the electronic codebook mode in accordance with the subsection 6.1. The encrypted filling of N1, N2 is the first block of the running key Gc(1) = A(S), this block is added bitwise modulo 2 in the adder CM5 with the encrypted data block Tc(1). This results in the first block of plain text Tp(1).
It should say:
The initial filling of N1 and N2 (the initialisation vector S) is encrypted in the electronic codebook mode in accordance with the subsection 5.1. The encrypted filling of N1, N2 is the first block of the running key Gc(1) = A(S), this block is added bitwise modulo 2 in the adder CM5 with the encrypted data block Tc(1). This results in the first block of plain text Tp(1).
Errata ID: 2150
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 8 says:
- The first block of plain text:
Tp(1) = (t1(1), t1(2), ..., t64(1)) = (a1(1)[0], a2(1)[0], ...,
a32(1)[0], b1(1)[0], b2(1)[0], ..., b32(1)[0])
It should say:
The first block of plain text:
Tp(1) = (t1(1), t1(2), ..., t64(1)) = (a1(1)[0], a2(1)[0], ...,
a32(1)[0], b1(1)[0], b2(1)[0], ..., b32(1)[0])
Errata ID: 2151
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 8 says:
The filling of N1 and N2 is transformed in accordance with the first 16 rounds of the encryption algorithm in the electronic codebook mode (see the subsection 6.1). In the KDS, there exists the same key that is used for encrypting the blocks of plain text Tp(1), Tp(2), ..., Tp(M) in the corresponding blocks of encrypted data Tc(1), Tc(2), ..., Tc(M).
It should say:
The filling of N1 and N2 is transformed in accordance with the first 16 rounds of the encryption algorithm in the electronic codebook mode (see the subsection 5.1). In the KDS, there exists the same key that is used for encrypting the blocks of plain text Tp(1), Tp(2), ..., Tp(M) in the corresponding blocks of encrypted data Tc(1), Tc(2), ..., Tc(M).
Errata ID: 2153
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Nikolai Malykh
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 8 says:
The resulting filling of N1 and N2 is added in the CM5 modulo 2 with the third block Tp(3), etc., the last block Tp(M) = (t1(M), t2(M), ..., t64(M)), padded if necessary to a complete 64-bit block by zeros, is added in CM5 modulo 2 with the filling N1, N2 (a1(M-1)[16], a2(M-1)[16], ..., a32(M-1)[16], b1(M-1)[16], b2(M-1)[16], ..., b32(M-1)[16]).
It should say:
The resulting filling of N1 and N2 is added in the CM5 modulo 2 with the third block Tp(3), etc., the last block Tp(M) = (t1(M), t2(M), ..., t64(M)), padded if necessary to a complete 64-bit block by zeros, is added in CM5 modulo 2 with the filling N1, N2 (a1(M-1)[16], a2(M-1)[16], ..., a32(M-1)[16], b1(M-1)[16], b2(M-1)[16], ..., b32(M-1)[16]).
Errata ID: 2154
Status: Verified
Type: Editorial
Publication Format(s) : TEXT
Reported By: Dolmatov V.
Date Reported: 2010-04-09
Verifier Name: Nevil Brownlee
Date Verified: 2013-03-12
Section 8 says:
The encrypted data Tc(1), Tc(2), ..., Tc(M), when arriving, are decrypted, out of the resulting plain text blocks Tp(1), Tp(2), ..., Tp(M). The MAC I'(l) is generated as described in the subsection 5.3 and compared with the MAC I(l) received together with the encrypted data from the telecommunication channel or from the computer memory. If the MACs are not equal, the resulting plain text blocks Tp(1), Tp(2), ..., Tp(M) are considered false.
It should say:
he encrypted data Tc(1), Tc(2), ..., Tc(M), when arriving, are decrypted, out of the resulting plain text blocks Tp(1), Tp(2), ..., Tp(M). The MAC I'(l) is generated as described above and compared with the MAC I(l) received together with the encrypted data from the telecommunication channel or from the computer memory. If the MACs are not equal, the resulting plain text blocks Tp(1), Tp(2), ..., Tp(M) are considered false.
Notes:
wrong reference to the original text sections