Re: [Cfrg] Handling invalid points

["D. J. Bernstein" <[e-mail]>]

Michael Hamburg writes:
> With a prime-order short Weierstrass curve, (x,y) points transmitted on
> the wire (compressed or otherwise) cannot be the identity

No, it's not that simple. As I wrote earlier: "For cofactor 1 the
implementor has to go digging through obscure, poorly tested code to
figure out how the point at infinity might end up being communicated
(e.g., does the implementation treat input points off the curve as
infinity?) and then represented internally. Isn't TLS actually moving to
something much more confidence-inspiring than such patches, namely
hashing more inputs?"

> The Goldilocks encoding reduces the complexity of dealing with this

No. Checking for output 0 from the Montgomery ladder is guaranteed to
catch all non-contributory inputs for X25519, and is the simplest
imaginable check. (The local factor 8 clears all of those inputs, and
the main theorem says that the ladder always multiplies correctly.)

Further compression---e.g., specifying a constant top byte, avoiding the
top bytes of non-contributory inputs---would move the check inescapably
into the syntax, although it would slow down key generation somewhat.

> behavior should be testable by vectors

Sure. On the other hand, people often put together test vectors that
cover only "normal" cases and not unusual cases. Protocols should be
designed to be robust against likely implementation errors.

---Dan