For the complete documentation index, see llms.txt.
aztec-nr - noir_aztec::messages::delivery::handshake

Function forgery_protected_eph_pk

pub fn forgery_protected_eph_pk(
    eph_pk: EmbeddedCurvePoint,
    recipient_point: EmbeddedCurvePoint,
) -> EmbeddedCurvePoint

Applies the forgery protection to a discovered ephemeral key.

The recipient never holds the raw S (its side of the ECDH happens inside PXE), so it cannot call protect_from_forgery on the secret directly. The protection is a scalar multiplication and therefore commutes through ECDH: protecting the ephemeral key before the shared-secret derivation yields the same protected secret S' the sender stored:

protected_eph_pk = forgery_protected_eph_pk(eph_pk, recipient_point) = k * eph_pk recipient_priv * protected_eph_pk = recipient_priv * (k * eph_pk) = k * (recipient_priv * eph_pk) = k * S = S'