I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8.
So an attacker is unable to gain any information using a public key of a smaller subgroup or on a invalid curve.
Does this mean a check that a public key is on the curve before a ECDH is unneccessary?
Th
You should still check as there are invalid curve attacks that give information other than the low bits of the key.
For example, the invalid curve attack of Neves and Tabouchi (Degenerate curve attacks: extending invalid curve attacks to Edwards curves and other models) uses the invalid point $(0,y)$ with $y\neq 1\pmod p$. If we use the Edwards formula to compute a scalar multiple by $k$ of this invalid point we get the answer $(0,y^k\mod p)$. If we choose $y$ to be primitive root modulo $p$ and have access to this answer, we can find $k$ by solving a multiplicative discrete logarithm modulo $p$ (which for a special prime of 255-bits is highly feasible on even moderate computational resources).
