# ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8.

So an attacker is unable to gain any information using a public key of a smaller subgroup or on a invalid curve.

Does this mean a check that a public key is on the curve before a ECDH is unneccessary?

Th

For example, the invalid curve attack of Neves and Tabouchi (Degenerate curve attacks: extending invalid curve attacks to Edwards curves and other models) uses the invalid point $$(0,y)$$ with $$y\neq 1\pmod p$$. If we use the Edwards formula to compute a scalar multiple by $$k$$ of this invalid point we get the answer $$(0,y^k\mod p)$$. If we choose $$y$$ to be primitive root modulo $$p$$ and have access to this answer, we can find $$k$$ by solving a multiplicative discrete logarithm modulo $$p$$ (which for a special prime of 255-bits is highly feasible on even moderate computational resources).