Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does not.

Can an attacker determine some private information when curve points are sent to unsuspecting users which don't lie on the curve?

If either ElGamal encryption or ElGamal signature are vulnerable, is there an obvious property that can be checked to see if another protocol is vulnerable?

Let's assume that the curve parameters are pre-shared and the system is set up.


1 Answer 1


In this state we have well known attack that is called invalid-curve attack.

Let $E:y^2=x^3+ax+b$ and $E':y^2=x^3+ax+b'$ be two elliptic curves with reduced Weierstrass form. $E'$ is called an invalid curve relative to $E$.

Since formulae for adding and doubling points on $E$ does not involve coefficient $b$ thus addition law for $E$ and $E'$ is same. In this attack, we can send several low order points and find the private key using the chinese remainder theorem.

For more detail you can see "Guide to Elliptic Curve Cryptography" page 182.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.