Skip to main content
Cryptography

Return to Answer

added 23 characters in body
Source Link
knaccc
knaccc
  • 4.8k
  • 1
  • 16
  • 32

every existing implementation implements scalar arithmetic $\operatorname{mod} q$

This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated.

Just in case it's not perfectly clear (I misread it the first time myself):

All they're saying is that when all scalars, when addedthere is a scalar operation with another scalar (e.g. addition, subtractedsubtraction, or multiplied with other scalarsmultiplication), the result is reduced $\operatorname{mod}q$.

Scalars are validated by checking they are less than $q$, and EC points are validated as being in the prime subgroup by multiplying them by $q$ and checking the result is the point at infinity.

When you're working with trusted or validated scalars/points, you don't have to worry about any of the problems discussed in the post you've linked to.

The reason that libraries don't validate is that depending on the scenario, there is no advantage to performing the validation, and the validation has a computational cost due to the additional scalar multiplication involved to validate the EC point.

every existing implementation implements scalar arithmetic $\operatorname{mod} q$

This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated.

Just in case it's not perfectly clear (I misread it the first time myself):

All they're saying is that when all scalars, when added, subtracted, or multiplied with other scalars, the result is reduced $\operatorname{mod}q$.

Scalars are validated by checking they are less than $q$, and EC points are validated as being in the prime subgroup by multiplying them by $q$ and checking the result is the point at infinity.

When you're working with trusted or validated scalars/points, you don't have to worry about any of the problems discussed in the post you've linked to.

The reason that libraries don't validate is that depending on the scenario, there is no advantage to performing the validation, and the validation has a computational cost due to the additional scalar multiplication involved to validate the EC point.

every existing implementation implements scalar arithmetic $\operatorname{mod} q$

This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated.

Just in case it's not perfectly clear (I misread it the first time myself):

All they're saying is that when there is a scalar operation with another scalar (e.g. addition, subtraction, multiplication), the result is reduced $\operatorname{mod}q$.

Scalars are validated by checking they are less than $q$, and EC points are validated as being in the prime subgroup by multiplying them by $q$ and checking the result is the point at infinity.

When you're working with trusted or validated scalars/points, you don't have to worry about any of the problems discussed in the post you've linked to.

The reason that libraries don't validate is that depending on the scenario, there is no advantage to performing the validation, and the validation has a computational cost due to the additional scalar multiplication involved to validate the EC point.

Source Link
knaccc
knaccc
  • 4.8k
  • 1
  • 16
  • 32

every existing implementation implements scalar arithmetic $\operatorname{mod} q$

This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated.

Just in case it's not perfectly clear (I misread it the first time myself):

All they're saying is that when all scalars, when added, subtracted, or multiplied with other scalars, the result is reduced $\operatorname{mod}q$.

Scalars are validated by checking they are less than $q$, and EC points are validated as being in the prime subgroup by multiplying them by $q$ and checking the result is the point at infinity.

When you're working with trusted or validated scalars/points, you don't have to worry about any of the problems discussed in the post you've linked to.

The reason that libraries don't validate is that depending on the scenario, there is no advantage to performing the validation, and the validation has a computational cost due to the additional scalar multiplication involved to validate the EC point.