Subject: Re: [TLS] Should we require compressed points

From: Peter Gutmann <[email-masked]>
Date: Wed, 22 Oct 2014 22:05:20 +0000

Watson Ladd <[email-masked]> writes:

>Ask Bouncycastle, Apple, and Go why they don't do this check. (Bouncycastle
>fixed it). The fact is implementations are exploitable as a result of taking
>shortcuts not revealed in ordinary testing.

Do you have more information on this?

In any case though, the determined programmer can goto fail no matter what you
do, so adding a requirement for point compression will just mean they'll screw
things up elsewhere.  In addition since they have to keep supporting
uncompressed points all it'll do is add more things for them to mess up.

Peter.