Cryptography - suggested verification of Diffie-Hellman points

[randomstuff]

Suggested recuirement from Bart Preneel:

6.7.2. [ADDED] For Diffie-Hellman and Elliptic Curve Diffie-Hellman, verify that the point received is legitimate: e.g, for Diffie-Hellman the values 0, 1, and p-1 are not valid and for Elliptic Curve Diffie-Hellman (ECDH) the point should lie on the elliptic curve and should not be the point P or the point at infinity.

[randomstuff]

It is indeed important that the code verifies that the DH points are valid.

I think the wording should be instead:

6.7.2. [ADDED] Verify that the when the application receives a Diffie-Hellman point for Diffie-Hellman key agreement, it verified that this point is valid. For Finite Field Diffie-Hellman the values 0, 1, and p-1 are not valid. For Elliptic Curve Diffie-Hellman (ECDH), the point should lie on the elliptic curve and should not be the point P or the point at infinity.

Question: I'm wondering what "the point P" is? Are we talking about the generator of the subgroup? If so, this requirement should equally apply to FFDH?

About "the point P", should this requirement apply to FFDH as well (i.e. the point should not be the generator)?

[randomstuff]

See RFC 2631 for some validation of Finite Field Diffie-Hellman public keys.

[tghosth]

I defer to @danielcuthbert