Confirm EcPointValidator.EnsureOnCurve is the public EC-validation entry point (decompress stays internal)

[moisesja]

Context

net-did has tests (EcPointValidatorTests) that reach into the internal DefaultCryptoProvider.DecompressEcPoint / DecompressSecp256k1Point. In NetCrypto these are internal (visible to NetCrypto.Tests only), so post-migration NetDid.Core.Tests cannot call them with a simple using swap.

Ask

Please confirm the intended public EC-validation surface is EcPointValidator.EnsureOnCurve (and friends), and that point decompression is intentionally an internal implementation detail.

net-did will rewrite those test cases against the public EcPointValidator API (which exercises the same on-curve validation), or delete them — the coverage is duplicated in NetCrypto.Tests.

No upstream change is preferred. Expose a public DecompressEcPoint only if you consider it generally useful (not recommended given the frozen-surface posture).

Severity

Minor.

[moisesja]

Confirmed (documented in #9). EcPointValidator.EnsureOnCurve(KeyType, x, y) is the public EC on-curve validation entry point (the invalid-curve-attack defense). Point decompression (DecompressEcPoint / DecompressSecp256k1Point) is an internal implementation detail and intentionally stays internal — on-curve validation does not require it, and we're keeping the public surface frozen. Recommendation as you suggested: rewrite EcPointValidatorTests against the public EnsureOnCurve (same validation), or delete them since coverage is duplicated in NetCrypto.Tests. This is now stated in the README and on EcPointValidator's XML docs.