From 397812dfc1b8573d62f1ca1b340e41dcb6774a60 Mon Sep 17 00:00:00 2001
From: Tony Arcieri <bascule@gmail.com>
Date: Tue, 2 Sep 2025 11:29:25 -0600
Subject: [PATCH] curve: add X25519_LOW_ORDER_POINTS constant

Adds a table of low order points, adapted from
https://cr.yp.to/ecdh.html, which suggests that non-Diffie-Hellman
protocols that depend on "contributory" behavior should reject them.

They're also useful for testing, e.g. how a protocol implementation
handles them during a key exchange (noting that a well-implemented AKE
shouldn't need to explicitly reject them, as someone attempting to use
them for MitM should be spotted as a transcript mismatch).
---
 curve25519-dalek/src/constants.rs | 46 +++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/curve25519-dalek/src/constants.rs b/curve25519-dalek/src/constants.rs
index 0a1162419..6f5ffa89c 100644
--- a/curve25519-dalek/src/constants.rs
+++ b/curve25519-dalek/src/constants.rs
@@ -88,10 +88,41 @@ pub static RISTRETTO_BASEPOINT_TABLE: &RistrettoBasepointTable = unsafe {
     &*(ED25519_BASEPOINT_TABLE as *const EdwardsBasepointTable as *const RistrettoBasepointTable)
 };
 
+/// X25519 low order points.
+///
+/// The output of any scalar multiplied by these points is zero. Protocols which need to ensure
+/// "contributory" behavior should reject these points.
+///
+/// Table adapted from <https://cr.yp.to/ecdh.html>.
+#[rustfmt::skip]
+pub static X25519_LOW_ORDER_POINTS: [MontgomeryPoint; 7] = [
+    // 0 (order 4)
+    MontgomeryPoint([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 1 (order 1)
+    MontgomeryPoint([0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 325606250916557431795983626356110631294008115727848805560023387167927233504 (order 8)
+    MontgomeryPoint([0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00]),
+
+    // 39382357235489614581723060781553021112529911719440698176882885853963445705823 (order 8)
+    MontgomeryPoint([0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b, 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57]),
+
+    // p - 1 (order 2)
+    MontgomeryPoint([0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    // p (order 4)
+    MontgomeryPoint([0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    // p + 1 (order 1)
+    MontgomeryPoint([0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f])
+];
+
 #[cfg(test)]
 mod test {
     use crate::constants;
     use crate::field::FieldElement;
+    use crate::montgomery::MontgomeryPoint;
     use crate::traits::{IsIdentity, ValidityCheck};
 
     #[test]
@@ -173,6 +204,21 @@ mod test {
         assert_eq!(should_be_ad_minus_one, ad_minus_one);
     }
 
+    #[test]
+    fn low_order_point_scalar_mul() {
+        // Example scalar from RFC7748 § 5.2
+        let scalar = [
+            0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d, 0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46,
+            0x5e, 0xdd, 0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18, 0x50, 0x6a, 0x22, 0x44,
+            0xba, 0x44, 0x9a, 0xc4,
+        ];
+
+        for low_order_point in constants::X25519_LOW_ORDER_POINTS {
+            let output = low_order_point.mul_clamped(scalar);
+            assert_eq!(output, MontgomeryPoint([0; 32]));
+        }
+    }
+
     /// Test that ED25519_SQRTAM2 squared is MONTGOMERY_A_NEG - 2
     #[test]
     #[cfg(feature = "digest")]