# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## Appendix A Weierstrass Elliptic Curve
### Binary Edwards Elliptic Curve  
A binary Edwards elliptic curve has the parameters \(d_{1}\) and \(d_{2}\) that satisfy the following equation:  
\[d_{1}(x+y)+d_{2}(x^{2}+y^{2})=(x+x^{2})(y+y^{2}) \tag{11}\]  
The projective coordinates represent \(x,y\) as \(X,Y,Z\) to satisfy the following equation:  
\[x=X/Z\quad\text{and}\quad y=Y/Z\]  
The equivalence class containing \((X,Y,Z)\) is  
\[(X:Y:Z)=(rX,rY,rZ):r\in\mathbb{F}. \tag{12}\]We describe a projective form of the unified point addition formula (add-2008-blr-4) given in [21]. Let \(P_{1}=(X_{1}:Y_{1}:Z_{1})\) and \(P_{2}=(X_{2}:Y_{2}:Z_{2})\); then, we can get \(P_{1}+P_{2}=(X_{3}:Y_{3}:Z_{3})\) with unified point addition for the binary Edwards elliptic curve:  
\[ \begin{cases}X_{3}=V+D(A+D)(G+D)\\ Y_{3}=V+D(B+D)(H+D)\\ Z_{3}=U+(d_{2}+d_{1})CK^{2},\end{cases} \] (A23)  
where  
\(A=X_{1}X_{2},\quad B=Y_{1}Y_{2},\quad C=Z_{1}Z_{2},\quad D=d_{1}C,\quad E=C^{2 },\quad F=D^{2},\)  
\(G=(X_{1}+Z_{1})(X_{2}+Z_{2}),\quad H=(Y_{1}+Z_{1})(Y_{2}+Z_{2}),\quad I=A+G,\)  
\(J=B+H,\quad K=(X_{1}+Y_{1})(X_{2}+Y_{2}),\quad U=C(F+d_{1}K(K+I+J+C)),\)  
\(V=U+DF+K(d_{2}(d_{1}E+GH+AB)+(d_{2}+d_{1})IJ).\)  
This formula requires 18 field multiplications. We found both Type 1 and Type 2 vulnerabilities during the computations of \(P_{1}+P_{2}\) for \(P_{1}\
eq P_{2}\) and \(P_{1}=P_{2}\). **Type 1 vulnerability**: Let us consider the computation \(A=[X_{1}]\cdot[X_{2}]\). In this formula, it is computed as \([X_{1}]\cdot[X_{1}]\) for \(P_{1}=P_{2}\), whereas it is computed as \([X_{1}]\cdot[X_{2}]\) for \(P_{1}\
eq P_{2}\). Similarly, for \(B=[Y_{1}]\cdot[Y_{2}],C=[Z_{1}]\cdot[Z_{2}]\), \(G=[(X_{1}+Z_{1})]\cdot[(X_{2}+Z_{2})]\), \(H=[(Y_{1}+Z_{1})]\cdot[(Y_{2}+Z_{2})]\), and \(K=[(X_{1}+Y_{1})]\cdot[(X_{2}+Y_{2})]\), these are computed as \(B=[Y_{1}]\cdot[Y_{1}]\), \(C=[Z_{1}]\cdot[Z_{1}]\), \(G=[(X_{1}+Z_{1})]\cdot[(X_{1}+Z_{1})]\), \(H=[(Y_{1}+Z_{1})]\cdot[(Y_{1}+Z_{1})]\), and \(K=[(X_{1}+Y_{1})]\cdot[(X_{1}+Y_{1})]\) for \(P_{1}=P_{2}\). Also, if \(P_{1}=P_{2}\), \(I\) and \(J\) compute as follows:  
\(I=A+G=X_{1}X_{1}+(X_{1}+Z_{1})(X_{1}+Z_{1})=X_{1}^{2}+X_{1}^{2}+Z_{1}^{2}=Z_{1}^ {2}\) and  
\(J=B+H=Y_{1}Y_{1}+(Y_{1}+Z_{1})(Y_{1}+Z_{1})=Y_{1}^{2}+Y_{1}^{2}+Z_{1}^{2}=Z_{1}^ {2}.\)  
Thus, if \(P_{1}=P_{2}\), \([I]\cdot[J]=[Z_{1}^{2}]\cdot[Z_{1}^{2}].\) An adversary can distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using ROSETTA. **Type 2 vulnerability**: Let us consider the computations \(U=[C]\cdot[(F+d_{1}K(K+I+J+C))]\), \([(d_{2}+d_{1})]\cdot[I]\cdot[J]\) in \(V\) and \([(d_{2}+d_{1})]\cdot[C]\cdot[K^{2}]\) in \(Z^{3}\). If \(P_{1}=P_{2}\), since \(C=I=J\), both operations have at least one same operand. Therefore, they can be distinguished using HCCA. By Algorithm 2, to use unified point addition on the binary Edwards elliptic curve, the two inputs of step 8 are expressed as follows:  
\[ \begin{cases}P_{1}=(X_{1}:Y_{1}:Z_{1}),P_{2}=(r_{1}X_{1}:r_{1}Y_{1}:r_{1}Z_{1} )\quad\text{ If }k^{\prime}=0,\\ P_{1}=(X_{1}:Y_{1}:Z_{1}),P_{2}=(r_{2}X_{2}:r_{2}Y_{2}:r_{2}Z_{2})\quad\text{ If }k^{\prime}=1.\end{cases} \] (A24)  
where \(r\
eq 1\). Although \(w\)RPC is applied to unified point addition, \(C=I=J\) for \(P_{1}=P_{2}\). Thus, we need to modify the unified point addition formula. The collision pairs exposed by HCCA are \((U=[C]\cdot[(F+d_{1}K(K+I+J+C))]\) and \([(d_{2}+d_{1})]\cdot[I]\cdot[J]\) in \(V\)) or \(([(d_{2}+d_{1})]\cdot[C]\cdot[K^{2}]\) in \(Z^{3}\) and \([(d_{2}+d_{1})]\cdot[I]\cdot[J]\) in \(V\)). Since both collision pairs contain the operation \([(d_{2}+d_{1})]\cdot[I]\cdot[J]\), we only have to mask its operands.