That sounds interesting. I'd like to test this hypothesis sometime ;)
> We also have similar safety models for things like invalid curve attacks.
What is your defense against invalid curve attacks exactly? I'm very curious about that (although your target audience largely won't care, so this post probably doesn't need to be updated).
Two defenses that work:
1. Always check that the (x, y) coordinate is a solution for the curve equation
2. Use compressed public key points
I prefer option 2 (especially since the patent on point compression expired years ago), but option 1 works.
That sounds great! Feel free to shoot me an email on [email protected] if you'd like to get further into the weeds :)
Our main defence against invalid curves is compressed public key points. It's not often that security mitigations also give some other nice advantages (smaller public keys!), but for this scenario it made total sense.
This is the point in Slack when I usually reply with a sparkly heart emoji.
I'll get in touch sometime. This is a busy month for me so I won't have a lot of spare cycles, but if I catch a break it might be fun to test. :D
More broadly, though, we don't currently use RSA and chose ECDH instead — so padding oracles aren't something we have to worry too much about. We also have similar safety models for things like invalid curve attacks.