I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following.
Unfortunately, there is a gap between ECDLP difficulty and ECC security. None of these standards do a good job of ensuring ECC security. There are many attacks that break real-world ECC without solving ECDLP. The core problem is that if you implement the standard curves, chances are you're doing it wrong:
- Your implementation produces incorrect results for some rare curve points.
- Your implementation leaks secret data when the input isn't a curve point.
- Your implementation leaks secret data through branch timing.
- Your implementation leaks secret data through cache timing.
So, I was curious about the second point. How is it possible to leak secret data when the input isn't a curve point. I am assuming it means the base point(P) is not on the curve, but then how would P+P be calculated and how would it make the implementation insecure?