Re: [Cfrg] On relative performance of Edwards v.s. Montgomery Curve25519, variable base

[Andrey Jivsov <[e-mail]>]

On 01/05/2015 08:28 PM, Watson Ladd wrote:
> Despite claims earlier in your email that certification stops the
> problem, invalid point attacks are a real threat.

I didn't mean to say it this way. Implementations have plenty of chances 
to do this wrong. One should not overestimate what this group can do, 
for example, about preventing an application from hardcoding an 
"ephemeral" ECDH key pair into the source code.

The point validation is a part of the group of tests that can be 
legitimately not claimed on the FIPS 140-2 validation. This is in 
ECDSAVS, sec 6.3 
http://csrc.nist.gov/groups/STM/cavp/documents/dss2/ecdsa2vs.pdf

Interesting about validation patents. I try not to read them. Checking 
that (x,y) satisfies some f(x,y)=0 seems to have prior art.