# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## 2 Preliminaries
### Rosetta and Hcca  
Recovery of secret exponent by triangular trace analysis (ROSETTA) [7] and horizontal collision correlation attack (HCCA) [6] are based on the observations of the power consumption of the cryptosystems during the executions of field multiplications. They are powerful attacks on elliptic curve cryptosystems since they use only one power consumption trace for SPA. ROSETTA and HCCA can be used to reveal secret information by analyzing the correlation between the secret bit value and the power consumption of field multiplications without any prior knowledge of the inputs. Details of the analyses are as follows.  
**ROSETTA**. [PERSON]'s attack needs a single power consumption trace to recover secret information. For each field multiplication, ROSETTA detects whether the operation is \(x\cdot x\) (squaring) or \(x\cdot y\) (multiplication). Let \(x=(x_{m-1},x_{m-2},...,x_{0})_{2^{w}}\) and \(y=(y_{m-1},y_{m-2},...,y_{0})_{2^{w}}\). A \(w\)-bit multiplication \(x_{i}\cdot y_{j}\) can be identified from the specific pattern in side-channel power consumption. ROSETTA considers the observation \(O_{1}\) and \(O_{2}\) extracted from the multiplication \(x_{i}\cdot y_{j}\) for all \(i\
eq j\):  
\((O_{1}):x\cdot y\) s.t \(x=y\Rightarrow\text{Prob}(x_{i}\cdot y_{j}=x_{j}\cdot y_{i})\)\(=1\) for all \(i\
eq j\)  
\((O_{2}):x\cdot y\) s.t \(x\
eq y\Rightarrow\text{Prob}(x_{i}\cdot y_{j}=x_{j}\cdot y_{i})\)\(\approx 0\) for all \(i\
eq j\)  
From the observations \(O_{1}\) and \(O_{2}\), collisions between \(x_{i}\cdot y_{j}\) and \(x_{j}\cdot y_{i}\) for all \(i\
eq j\) can be used to identify squarings from multiplications. To identify these collisions of field multiplication trace, ROSETTA exploits a triangle trace analysis which uses a Euclidean distance distinguisher relying on a collision correlation technique.  
**HCCA**. [PERSON] et al. introduced this method to extract keys using the collision of field multiplications in a single power consumption trace. The core idea of this attack is that collision occurs during two field multiplication computations when the same operands are used, which can be detected by HCCA. When performed in a horizontal setting, the observations \(O_{1}\) and \(O_{2}\) are extracted from the two field multiplications.  
\((O_{1}):x_{1}\cdot y_{1}\) and \(x_{2}\cdot y_{2}\) s.t \(x_{1}=x_{2}\) and \(y_{1}=y_{2}\Rightarrow\text{Prob}((x_{1})_{i}\cdot(y_{1})_{j}=(x_{2})_{i}\cdot (y_{2})_{j})=1\) for all \(i,j\)  
\((O_{2}):x_{1}\cdot y_{1}\) and \(x_{2}\cdot y_{2}\) s.t \(x_{1}\
eq x_{2}\) and \(y_{1}\
eq y_{2}\Rightarrow\text{Prob}((x_{1})_{i}\cdot(y_{1})_{j}\
eq(x_{2})_{ i}\cdot(y_{2})_{j})\approx 0\) for all \(i,j\)  
The correlation between the two observations is then estimated by Pearson's coefficient in order to determine whether the two operands of the field multiplications are the same or different.  
The advantage of these analyses is that the inputs of field multiplication can remain unknown since the adversary does not need to compute intermediate values. Countermeasures against ROSETTA and HCCA include shuffling the operands and blinding the operands of a field multiplication [10]. For \(n\)-bit field multiplication, the blinding operand method requires \(t^{2}+2t+1\)\(w\)-bit multiplications, where \(t=\lceil n/w\rceil\). Unified point addition using blinding operands requires a great additional computational cost. Therefore, for efficiency, we propose a suitable and efficient countermeasure for the unified point addition operation, and we compare and analyze the proposed method with the existing unified point addition method using blinding operands on the binary Huff curve.