golang/go · error

P256 point is the point at infinity

Error message

P256 point is the point at infinity

What it means

Thrown by P256Point.BytesX() (fiat-based implementation) when the receiver is the point at infinity — the elliptic curve identity element where z == 0. The identity has no affine x-coordinate, so the SEC 1 x-coordinate encoding is mathematically undefined. This is a defensive guard: the library refuses to serialize an unrepresentable value rather than returning garbage.

Source

Thrown at src/crypto/internal/fips140/nistec/p256.go:186

	buf := append(out[:0], 4)
	buf = append(buf, x.Bytes()...)
	buf = append(buf, y.Bytes()...)
	return buf
}

// BytesX returns the encoding of the x-coordinate of p, as specified in SEC 1,
// Version 2.0, Section 2.3.5, or an error if p is the point at infinity.
func (p *P256Point) BytesX() ([]byte, error) {
	// This function is outlined to make the allocations inline in the caller
	// rather than happen on the heap.
	var out [p256ElementLength]byte
	return p.bytesX(&out)
}

func (p *P256Point) bytesX(out *[p256ElementLength]byte) ([]byte, error) {
	if p.z.IsZero() == 1 {
		return nil, errors.New("P256 point is the point at infinity")
	}

	zinv := new(fiat.P256Element).Invert(&p.z)
	x := new(fiat.P256Element).Mul(&p.x, zinv)

	return append(out[:0], x.Bytes()...), nil
}

// BytesCompressed returns the compressed or infinity encoding of p, as
// specified in SEC 1, Version 2.0, Section 2.3.3. Note that the encoding of the
// point at infinity is shorter than all other encodings.
func (p *P256Point) BytesCompressed() []byte {
	// This function is outlined to make the allocations inline in the caller
	// rather than happen on the heap.
	var out [p256CompressedLength]byte
	return p.bytesCompressed(&out)
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Check whether the point is the identity before calling BytesX — call p.Bytes() and test for the 1-byte 0x00 encoding
2. Validate the result of ScalarMult before extracting coordinates
3. Ensure scalar inputs are non-zero and within the valid range [1, n-1] before multiplication
4. If doing ECDH, reject peer public keys that decode to the identity point

Example fix

// before
x, err := point.BytesX()
if err != nil {
    return err
}

// after
enc := point.Bytes()
if len(enc) == 1 && enc[0] == 0 {
    return errors.New("derived point is identity; reject key")
}
x, err := point.BytesX()
if err != nil {
    return err
}

// Check if a P256Point is the identity before extracting x-coordinate.
func mustNotBeInfinity(p *nistec.P256Point) error {
    enc := p.Bytes()
    if len(enc) == 1 && enc[0] == 0 {
        return errors.New("point is identity; cannot extract x-coordinate")
    }
    return nil
}

// Usage:
if err := mustNotBeInfinity(point); err != nil { return err }
x, err := point.BytesX()

x, err := point.BytesX()
if err != nil {
    // err contains "point at infinity" — the scalar or peer key is invalid.
    // Do NOT retry with the same inputs; reject the operation.
    return fmt.Errorf("cannot extract x-coordinate: %w", err)
}

When it happens

Trigger: Calling p.BytesX() on a P256Point whose z field is zero. This happens when ScalarMult yields the identity (scalar ≡ 0 mod n), when NewP256Point() is used without setting coordinates, when a point is added to its inverse, or when a deserialized 0x00-encoded point is passed.

Common situations: ECDH key agreement where the peer supplies the identity/zero public key; ECDSA signature verification where the nonce k produces r = 0×G; scalar multiplication with an all-zero or all-0xFF scalar that reduces to zero modulo the group order; calling BytesX() on an uninitialized P256Point.

Related errors

• P256 point is the point at infinity
• {{.P}} point is the point at infinity
• invalid P256 compressed point encoding
• invalid P256 point encoding
• P256 point not on curve

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f6752edae54bbc19. Report an issue: GitHub.