News for hackers. Stuff that matters.

A comment on Elligator: Elliptic-curve points indistinguishable from uniform random strings. Parent comment

Re:Elligator: Elliptic-curve points indistinguishable from u... by nmadden on Thursday July 18, 2024 @08:22AM (#40994924)
If a single point matches the curve equation of a well-known curve then that’s pretty compelling evidence.
[ Parent | on HN ]
Re:Elligator: Elliptic-curve points indistinguishable from u... by kientuong114 on Thursday July 18, 2024 @11:51AM (#40996854)
The point is that any random byte string can be decoded by Elligator to become a point matching the curve equation. This means that such a check is virtually useless and tells you nothing about whether there is a hidden key exchange happening or not.
[ Parent | on HN ]
Re:Elligator: Elliptic-curve points indistinguishable from u... by Retr0id on Thursday July 18, 2024 @08:23AM (#40994927)
not for compressed point representations (hence "depending on format")
[ Parent | on HN ]
Re:Elligator: Elliptic-curve points indistinguishable from u... by nmadden on Thursday July 18, 2024 @08:44AM (#40995054)
So just X25519 then?
[ Parent | on HN ]
Re:Elligator: Elliptic-curve points indistinguishable from u... by Retr0id on Thursday July 18, 2024 @08:46AM (#40995074)
No, most curves support a compressed (x coord, parity/sign bit) representation. It's what you'd probably be using if Elligator didn't exist, so makes sense as the point of comparison.

https://datatracker.ietf.org/doc/draft-mattsson-tls-compact-...

[ Parent | on HN ]