SPRUJB6B November 2024 – May 2025 AM2612
Some of the ECC algorithms may result in MCG error if one of the intermediate values causes a nonunified double or produces the point at infinity. This is deliberate as there is no way of handling this without it being potentially visible in some side-channel. Moreover, while this condition can happen deterministically depending on the signature, the probability of it occurring is cryptographically negligible. In fact, since such occurrence would reveal the private key, the probability that a properly generated signature produces the point at infinity problem is roughly equivalent to the probability of recovering the private key from the public key. In other words, this probability is negligible in any practical scenario.
However, if one generates signatures with trivial or short keys (extreme examples being 1 or -1), one significantly increases the probability of a point at infinity. Such signatures cannot be considered “properly generated”. Care is therefore advised when testing the PKE implementations with simple test vectors such as those available at https://point-at-infinity.org/ecc/nisttv. Likewise, some sets of test vectors contain tests that have been designed to determine whether the point at infinity is correctly handled, for example https://github.com/google/wycheproof, and those specific tests will fail.