RFC 9497, "Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups", December 2023

Errata ID: 7999
Status: Reported
Type: Technical
Publication Format(s) : PDF
Reported By: Quanwei Cai
Date Reported: 2024-06-24

Section 3.3.3 says:

evaluatedElement = G.ScalarInverse(t) * blindedElement

It should say:

evaluatedElement = t * blindedElement

Notes:

This appears in def BlindEvaluate(skS, blindedElement, info). It seems that the evaluatedElement=t * blindedElement, which is consistent with tweakedKey = t * G.Generator()

Report New Errata