Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Question

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does not.

Can an attacker determine some private information when curve points are sent to unsuspecting users which don't lie on the curve?

If either ElGamal encryption or ElGamal signature are vulnerable, is there an obvious property that can be checked to see if another protocol is vulnerable?

Let's assume that the curve parameters are pre-shared and the system is set up.

Answer 1

In this state we have well known attack that is called invalid-curve attack.

Let $E:y^2=x^3+ax+b$ and $E':y^2=x^3+ax+b'$ be two elliptic curves with reduced Weierstrass form. $E'$ is called an invalid curve relative to $E$.

Since formulae for adding and doubling points on $E$ does not involve coefficient $b$ thus addition law for $E$ and $E'$ is same. In this attack, we can send several low order points and find the private key using the chinese remainder theorem.

For more detail you can see "Guide to Elliptic Curve Cryptography" page 182.