CofactorClearing/

[utterances-bot]

Clamping & Cofactor clearing in Curve25519 – Risen Crypto – Mathematical Cryptography, zkSNARKs

https://risencrypto.github.io/CofactorClearing/

[skaunov]

Feels like it's much more complex than interception due to discr. log. problem, so Mallory have to get the scalar $b$ from Bob.

a man in the middle (Mallory) intercepts bG

[RisenCrypto]

Feels like it's much more complex than interception due to discr. log. problem, so Mallory have to get the scalar b from Bob.

a man in the middle (Mallory) intercepts bG

He doesn't have to get scalar b. Mallory just has to replace bG sent by Bob with H. So Alice gets H instead of bG. Alices multiplies it by a and uses aH as the shared secret thinking it's actually abG. Mallory can easily brute force & find aH because it can be only one of 8 points.