In the step H2, RFC specification says
2. While tlen < qlen, do the following: V = HMAC_K(V) T = T || V
but in Java implementation in the RFC appendix, we found the comparison with rolen
That does not provide the same result.
For example if used with Stark curve with prime field equal to
0x0800000000000011000000000000000000000000000000000000000000000001, qlen is 252 and rolen is 256
As consequence the loop occurs twice with rolen, but only once with qlen. it doesn't change the first k value but the subsequent k change.
The RFC code has been used now from third software.
Any thought about that?