# Tag Info

An attack is described in Section 4.1.6 of the SEC1 document. Regarding xagawa's answer: The attack you describe is different from that described in Section 4.5 of the Blake-Wilson--Menezes paper. Specifically, their attack: (a) does not require knowledge of the secret ephemeral key $k$, and (b) changes the reference point $P$, which is not allowed in ...