Re: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

[Taylor R Campbell <[e-mail]>]

   Date: Mon, 16 Nov 2015 18:29:42 -0800
   From: Mike Hamburg <[e-mail]>

   > On Nov 16, 2015, at 18:01, Phillip Hallam-Baker <[e-mail]> wrote:
   > 
   > Is there a mechanism that would allow an attacker to force use of
   > all zeros?

   Yes, an attacker can easily force it by sending specific values of
   g^x, most of which cannot be produced by a legitimate
   implementation.  There are something like 5 such values for
   curve448 and 14 such values for curve25519.

A malicious peer can do that, but so what?  A malicious peer can also
use a secret key k known to an eavesdropper, and send k*B where B is
the standard base point.  Then the eavesdropper seeing the good guy's
public key h*B over the wire can readily predict k*h*B and find the
session key.  A malicious peer could also email the session transcript
to the eavesdropper.

What is the serious attack that is prevented by a zero check?  It
seems to me an answer to that question is more important than the
choice of verb.