Re: [Cfrg] (flaws with Curve25519 DH function, if one does not check the output) Re: Elliptic Curves - curve form and coordinate systems

[CodesInChaos <[e-mail]>]

In fact several implementations started by ignoring the bit, then in
an attempt to achieve consistency I convinced them to use the bit
(conforming to the original specification) and finally after some
discussion they changed back to ignoring it (since ignoring makes
embedding a sign bit easier).

Bernstein documents which inputs (bitstrings) you need to ignore to
achieve contributory behaviour at:

http://cr.yp.to/ecdh.html

But that documentation assumes that the high bit is used. So a
blacklist based on that documentation will accept some low order
points with many implementations.