In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019, they talk about attacks in Bluetooth pairing, they state that in the pairing process which involves ECDH key exchange- "sending both the x-coordinate and the y-coordinate during the public key exchange is a design flaw as it is unnecessary and highly inadvisable, and it greatly increases the attack surface"

I'm aware that in other implementations only $x$-coordinate is sent in compressed form. I'm curious to know how sending both coordinates increases the attack surface, how important it is to know the information about the $y$-coordinate and what are the possible attacks related to this.


1 Answer 1


The paper you reference mentions that although both coordinates are sent, the protocol only requires the x-coordinate to be authenticated and validated. This means that the y-coordinate is free to be manipulated in implementations that do the bare minimum. As mentioned in a comment, "poor programmers and bad quality testers will not consider [this vulnerability]".

Sending only one coordinate makes it less likely for an implementer to make a mistake. With only one coordinate, it's impossible for the second coordinate to be manipulated, and it's significantly harder to force someone to use a point not on the curve. It's easier to test that given a value, a function always generates a valid point or throws an error than it is to test that a protocol works correctly end-to-end for all possible inputs.

  • $\begingroup$ I understand what you are trying to convey here, but I was thinking if there was anything else associated when it says "increased attack surface". Thanks. $\endgroup$
    – shijuza
    Commented Aug 12, 2020 at 20:57
  • $\begingroup$ During our research we discovered multiple design flaws in the Bluetooth specification. We then tested different Bluetooth implementations and found that a large majority of the Bluetooth devices are vulnerable. So, some has better team despite of the protocol flaw, or they just lucky. $\endgroup$
    – kelalaka
    Commented Aug 12, 2020 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.