# Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does not.

Can an attacker determine some private information when curve points are sent to unsuspecting users which don't lie on the curve?

If either ElGamal encryption or ElGamal signature are vulnerable, is there an obvious property that can be checked to see if another protocol is vulnerable?

Let's assume that the curve parameters are pre-shared and the system is set up.

• This SafeCurves page gives a nice overview on invalid-point attacks. Apr 22, 2016 at 15:23

Let $E:y^2=x^3+ax+b$ and $E':y^2=x^3+ax+b'$ be two elliptic curves with reduced Weierstrass form. $E'$ is called an invalid curve relative to $E$.
Since formulae for adding and doubling points on $E$ does not involve coefficient $b$ thus addition law for $E$ and $E'$ is same. In this attack, we can send several low order points and find the private key using the chinese remainder theorem.