scipr-lab / libff

C++ library for Finite Fields and Elliptic Curves
Other
153 stars 86 forks source link

Point deserialization lacks checks and sanitization #51

Open AntoineRondelet opened 4 years ago

AntoineRondelet commented 4 years ago

See thread here: https://github.com/scipr-lab/libff/pull/43#discussion_r462920866

TL;DR: No checks are made to verify that the recovered point lies on the curve, and nothing is done to make sure that we are manipulating elements of the safe subgroup.