I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8.

So an attacker is unable to gain any information using a public key of a smaller subgroup or on a invalid curve.

Does this mean a check that a public key is on the curve before a ECDH is unneccessary?



1 Answer 1


You should still check as there are invalid curve attacks that give information other than the low bits of the key.

For example, the invalid curve attack of Neves and Tabouchi (Degenerate curve attacks: extending invalid curve attacks to Edwards curves and other models) uses the invalid point $(0,y)$ with $y\neq 1\pmod p$. If we use the Edwards formula to compute a scalar multiple by $k$ of this invalid point we get the answer $(0,y^k\mod p)$. If we choose $y$ to be primitive root modulo $p$ and have access to this answer, we can find $k$ by solving a multiplicative discrete logarithm modulo $p$ (which for a special prime of 255-bits is highly feasible on even moderate computational resources).

  • $\begingroup$ ok that means there are even more possibilities that are not covered by that, thank you for your anser. I will take a deeper look at that. $\endgroup$
    – FooBar
    Feb 3, 2022 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.