Lion Cipher Lab
Implement ECDH from scratch — then break it with an invalid-curve attack and recover the private key
- Foundations
- Advanced
- ~75 min
- Free · no account required
Why it matters
Almost every fresh TLS handshake, every Signal message, every SSH login and every modern VPN agrees on its key with elliptic-curve Diffie-Hellman, not the finite-field kind — ECDH gives the same security as a 3072-bit finite-field group in a 32-byte public key, which is why it won. But the move to curves brought a failure mode that is subtler and nastier than anything in finite-field DH: the elliptic-curve group law does not use the curve's b coefficient at all, so if you multiply your secret key by a point without first checking that point is actually on your curve, you are silently doing…
What you'll learn
- implementing the elliptic-curve group law from scratch in pure Python 3 — point addition, doubling, and every edge case (the point at infinity as identity, P + (-P) via the vertical line, the vertical-tangent y=0 doubling case)
- scalar multiplication by double-and-add — the elliptic-curve analogue of modular exponentiation — and verifying k*G lands where the group order says it must
- recognising a SINGULAR curve by its zero discriminant (4a^3 + 27b^2 = 0) and knowing why the group law breaks on it
- running an ECDH key exchange over a curve and understanding that a raw curve point is NOT a key — it must go through a KDF
- executing an invalid-curve / small-subgroup attack end-to-end because the victim never validated the received point, and recovering a static private key
- combining several small-subgroup congruences with the Chinese Remainder Theorem to reconstruct the full private scalar
- writing the point-validation check that stops it: range check, on-curve check, and prime-order-subgroup check
- explaining why Curve25519/X25519 makes invalid-curve attacks structurally impossible — x-only Montgomery ladder, twist security, and cofactor clamping — and judging when to reach for it
Steps in this lab
- The idea, and the five words you need
- Set up, and write the group law by hand — every edge case
- Pick a curve that actually works — the singular-curve trap
- Run the exchange — and remember a point is not a key
- BREAK IT — the invalid-curve attack, in principle
- BREAK IT — recover the private key by CRT, then close the hole
- The better answer — why the world moved to Curve25519 / X25519
- The judgment: what to actually take away