# ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1.

Can i achieve something like this in ECDH? where Bob can calculate the shared key without knowing the private key?

Similarly, just send the identity element $$\mathcal{O}$$ as the public key.

Alice must be a fool to not validate the public key to fall into this trap. The first rule is to check that $$P \neq \mathcal{O}$$

Update per user's comment

How can i find the identity element of curve 25519?

The identity of some curves like Curve25519 is the point of infinity ( represented as $$\mathcal{O} \text { or } \infty$$) and this can't be represented in the affine coordinates. We need to use projective coordinate systems.

We took the Curve25519 equation $$y^2 = x^3 + 486662 x^2 + x$$ and convert it into homogeneous equation $$Y^2 Z - X^3 - 486662 X^2 Z - X Z^2$$

Now the points are triple $$(X:Y:Z)$$ where actually a point now represent a line $$(\lambda X:\lambda Y: \lambda Z)$$

The point at infinity is $$(0:1:0)$$ and this cannot be treated as an affine point.

Any affine point $$(x,y)$$ can be turned into homogenous by $$(x:y:1)$$ and any homogenous point other than the infinity $$(X:Y:Z)$$ can be turned back with $$(X/Z,Y/Z)$$.

• Another potential defense is simply not have a 'bits-on-the-wire' representation that you interpret as $\mathcal{O}$; hence you cannot possibly receive it... Apr 12, 2021 at 21:08
• @poncho any library does this? Apr 12, 2021 at 21:12
• Well, if you're conforming to a spec that specifies formats (such as TLS or IKE), and they don't specify how you would transmit $\mathcal{O}$ (which TLS/IKE doesn't for P256), hence they'd have to do it. Apr 12, 2021 at 21:26
• @kelalaka How can i find the identity element of curve 25519? Apr 15, 2021 at 17:39
• @AshrafYassin updated the asnwer. Apr 15, 2021 at 20:03