Should ECDH re-check pubkey is a curve point to avoid leaking private key? #555

I am thinking of the 'invalid curve' attack mentioned here: https://safecurves.cr.yp.to/twist.html

It looks like secp256k1_ecdh is supposed to be fool-proof so it may be good if it checks that the provided pubkey is actually a curve point. I know that secp256k1_pubkey is supposed to be opaque and thus already checked, but I suspect some people may try to shove in the key data directly.

The internal structure in secp256k1_pubkey is platform dependent, and doesn't usually match the common EC serialization, so if someone is pushing raw pubkeys directly into secp256_pubkey, it's already very unlikely that anything works at all.

Sounds good. :+1: