Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does not.
Can an attacker determine some private information when curve points are sent to unsuspecting users which don't lie on the curve?
If either ElGamal encryption or ElGamal signature are vulnerable, is there an obvious property that can be checked to see if another protocol is vulnerable?
Let's assume that the curve parameters are pre-shared and the system is set up.