# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## Appendix A Weierstrass Elliptic Curve
### Hessian Elliptic Curve  
A Hessian elliptic curve has a parameter \(d\) that satisfies the following equation:  
\[x^{3}+y^{3}+1=3 dxy \tag{11}\]  
\begin{table}
\begin{tabular}{c c c} \hline
**Out** & \(\mathbf{P_{1}=P_{2}}\) & \(\mathbf{P_{1}\
eq P_{2}}\) \\ \hline \(U_{1}\) & \([X_{1}]\cdot[r_{1}Z_{1}]\) & \([X_{1}]\cdot[r_{2}Z_{2}]\) \\ \(U_{2}\) & \([r_  
The projective coordinates represent \(x,y\) as \(X,Y,Z\) satisfying the following equation:  
\[x=X/Z\quad\text{and}\quad y=Y/Z\]  
The equivalence class containing \((X,Y,Z)\) is  
\[(X:Y:Z)=(\lambda X,\lambda Y,\lambda Z):\lambda\in\mathbb{F}.\] (A6)  
We describe a projective form of the unified point addition formula (add-2009-bkl) given in [21]. Let \(P_{1}=(X_{1}:Y_{1}:Z_{1})\) and \(P_{2}=(X_{2}:Y_{2}:Z_{2})\); then, we get \(P_{1}+P_{2}=(X_{3}:Y_{3}:Z_{3})\) with the unified point addition formula for the Hessian elliptic curve:  
\[\begin{cases}X_{3}=DC-FA\\ Y_{3}=BA-DE\\ Z_{3}=FE-BC,\end{cases}\] (A7)  
where  
\[\begin{array}{ll}A=Y_{1}X_{2},&B=Y_{1}Y_{2},\quad C=Z_{1}Y_{2},\\ D=Z_{1}Z_{2},&E=X_{1}Z_{2},\quad F=X_{1}X_{2}.\end{array}\]  
This formula requires 12 field multiplications. We can identify vulnerabilities of Type 1 and Type 2 during the computations of \(P_{1}+P_{2}\) for \(P_{1}\
eq P_{2}\) and \(P_{1}=P_{2}\).  
**Type 1 vulnerability**: Let us consider the computation \(B=[Y_{1}]\cdot[Y_{2}]\). In this formula, it is computed as \([Y_{1}]\cdot[Y_{1}]\) for \(P_{1}=P_{2}\), whereas it is computed as \([Y_{1}]\cdot[Y_{2}]\) for \(P_{1}\
eq P_{2}\). Similarly, in \(D=[Z_{1}]\cdot[Z_{2}]\) and \(F=[X_{1}]\cdot X_{2}]\), these are computed as \([Z_{1}]\cdot[Z_{1}]\) and \([X_{1}]\cdot[X_{1}]\) for \(P_{1}=P_{2}\), respectively. Thus, we can distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using ROSETTA.  
**Type 2 vulnerability**: Let us consider the computations \(A=[Y_{1}]\cdot[X_{2}]\) and \(C=[Z_{1}]\cdot[Y_{2}]\). If \(P_{1}=P_{2}\), then \([Y_{1}]\cdot[X_{1}]\) and \([Z_{1}]\cdot[Y_{1}]\) are computed. Thus, they have the same operand \(Y_{1}\) when \(P_{1}=P_{2}\) but not when \(P_{1}\
eq P_{2}\). Similarly, considering \(C=[Z_{1}]\cdot[Y_{2}]\) and \(E=[X_{1}]\cdot[Z_{2}]\), the multiplications for \(C\) and \(E\) have the same operand \(Z_{1}\) for \(P_{1}=P_{2}\) and different operands for \(P_{1}\
eq P_{2}\). Also, the multiplications for \(A\) and \(E\) have the same operand \(X_{1}\) for \(P_{1}=P_{2}\). Therefore, we can distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using HCCA.  
When applying \(w\)RPC to unified point addition on the Hessian elliptic curve, the two inputs are expressed as follows:  
\[\begin{cases}P_{1}=(X_{1}:Y_{1}:Z_{1}),P_{2}=(r_{1}X_{1}:r_{1}Y_{1}:r_{1}Z_{1 })&\text{If $k^{\prime}=0$,}\\ P_{1}=(X_{1}:Y_{1}:Z_{1}),P_{2}=(r_{2}X_{2}:r_{2}Y_{2}:r_{2}Z_{2})&\text{If $k^{ \prime}=1$.}\end{cases}\] (A8)  
where \(r\
eq 1\). It is sufficient to secure against Type 1 and Type 2 vulnerabilities by applying \(w\)RPC to unified point addition. The application of \(w\)RPC to unified point addition is evaluated in Table A3. Table A3 shows that vulnerabilities of Type 1 and Type 2 no longer exist.