Into the symmetry

tl;dr Firefox and Java suffered from a moderate vulnerability affecting the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result POINT_AT_INFINITY when it should not. Introduction Few months ago I was working on a vulnerability affecting the internet standard JWE (slides here ) and I got a stroke of luck . Yuppieeee  Basically I was constructing the malicious JWEs needed for the Demo Attack . When something weird happened :S You can try and share with me the surprise I had, the gist is here If you try to execute this class with Java 1.7 you basically have Exception in thread "main" java.lang.IllegalStateException     at sun.security.ec.ECDHKeyAgreement.deriveKey(Native Method)     at sun.security.ec.ECDHKeyAgreement.engineGenerateSecret(ECDHKeyAgreement.java:130)     at javax.crypto.KeyAgreement.generateSecret(KeyAgreement.java:586)     at orig...

tl;dr This short blog post serves to me to recollect some of the thing I have been learning ( climbing ) about Elliptic Curves Cryptography (ECC from now on) during the last months/years, so please take it with a grain of salt since it might contains some erroneous beliefs. '80 - Introduction Giambattista Vico   was an Italian political philosopher and rhetorician, historian and jurist, of the Age of Enlightenment famous (also) for the concept of historical courses and resorts. This can be resumed with: "some events are repeated in the same way even after a long time; and this is not by chance" . Well it seems that this might also applies to ECC so he maybe he was right :) Elliptic Curve made its first appearance in cryptography with Lenstra in 1984 (eventually published in 1987). Curiously enough he introduced them not while trying to come up with a new crypto system but he employed EC in order to factor integers (a side note, there is a really beauti...