RFC 7686 is outdated about key collision/impersonation
Since the Onion Services protocol v3 adoption and the v2 sunsetting, that paragraph from the RFC 7686 - The ".onion" Special-Use Domain Name became outdated:
The cryptographic label for a .onion name is constructed by applying
a function to the public key of the server, the output of which is
rendered as a string and concatenated with the string .onion.
Dependent upon the specifics of the function used, an attacker may be
able to find a key that produces a collision with the same .onion
name with substantially less work than a cryptographic attack on the
full strength key. If this is possible the attacker may be able to
impersonate the service on the network.
Since the .onion address now uses the full-length key, .onion address collision remains possible, but that now would happen only in case of
- The private key being stealed or leaked, which is related to bad OPSEC.
- A cryptographic attack on the full key, which is very hard.
I can see that the text "Dependent upon the specifics of the function used" might already cover a function that does not truncate the public key to derive the public .onion address, but shall we anyway consider an errata/amendment/addendum to the RFC?