[edelbitter]

Bernstein also published a simple checklist [1] of what people are likely to do wrong if not ruled out by design. Bullet point 2 on that list was:

> Your implementation leaks secret data when the input isn't a curve point.

[1]: https://safecurves.cr.yp.to/