# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## 5 Countermeasures
### Security Analysis of the Proposed Method  
In this section, we analyze Type 1 and Type 2 vulnerabilities of Algorithm 2 using the proposed unified point addition method. Let the input \(R_{2}=(X_{1}:Y_{1}:Z_{1})\) in step 4 and let the input \(R_{1}=(X_{2}:Y_{2}:Z_{2})\) in step  
\(m_{1}=(X_{1})(r_{1}X_{1}),\quad m_{2}=(Y_{1})(r_{1}Y_{1}),\quad m_{3}=(Z_{1})(r_{1 }Z_{1}),\) \(m_{4}=(X_{1}+Z_{1})(r_{1}X_{1}+r_{1}Z_{1}),\quad m_{5}=(Y_{1}+Z_{1})(r_{1}Y_{1}+ r_{1}Z_{1}).\) For \(m_{1}\), although \(P_{1}=P_{2}\), the operands \(X_{1}\) and \(r_{1}X_{1}\) are different. Similarly, the operands of the field multiplications for \(m_{2},m_{3},m_{4}\), and \(m_{5}\) are different. Also, there is no other field multiplication vulnerable to Type 1. Thus, the proposed algorithm is secure against the Type 1 vulnerability for the binary Huff curve.  
**Type 2 vulnerability**: Although \(w\)RPC is applied to the proposed unified point addition operation, \(m_{4}=[(X_{1}+Z_{1})]\cdot[(r_{1}X_{1}+r_{1}Z_{1})]=r_{1}(X_{1}X_{1}+Z_{1}Z_{1})\) and \(m_{1}+m_{3}=r_{1}X_{1}X_{1}+r_{1}Z_{1}Z_{1}\) when \(P_{1}=P_{2}(k^{\prime}=0)\). Thus, \(m_{4}=m_{1}+m_{3}\). Similarly, \(m_{5}m_{8}=m_{11}\). Thus, if we compute \([m_{11}]\cdot[(m_{1}+m_{3})]\), \([m_{4}]\cdot[m_{11}]\), and \([m_{5}m_{8}]\cdot[(m_{1}+m_{3})]\) as the previous unified point addition operation, their operands are the same when \(P_{1}=P_{2}\). On the other hand, they are different when \(P_{1}\
eq P_{2}\). Likewise, the operands of \([m_{8}]\cdot[(m_{2}+m_{3})]\) and \([m_{5}]\cdot[m_{8}]\) are the same when \(P_{1}=P_{2}\). They become targets to a Type 2 vulnerability. The reason for this vulnerability is that the same intermediate results occur in the previous unified point addition operation. They are used as inputs to more than one multiplication without modification for \(P_{1}=P_{2}\). Thus, we used the proposed method to mask the operands of vulnerable multiplications. Considering \([m_{4}]\cdot[m_{11}]\) and \([m_{11}]\cdot[(m_{1}+m_{3})]\) in Table 1, since the operand \(m_{11}\) is identically used in two multiplications, they do not affect the vulnerability. Thus, we only have to mask the other operand \(m_{4}\) (or \(m_{1}+m_{3}\)). Specifically, we computed \([m_{4}]\cdot[m_{11}]\) as \([(m_{4}+M)]\cdot[m_{11}]+M\cdot m_{11}\) so that an adversary cannot distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using a Type 2 vulnerability. However, we additional cost is incurred for \(M\cdot m_{11}\). To reduce this additional cost, we computed \([m_{4}]\cdot[m_{11}]\) as \([(m_{4}+m_{11})]\cdot[m_{11}]+m_{11}^{2}\) to use the advantage of zero computational cost for squaring in a binary field, which is almost free. Similarly, we applied masking to \([m_{5}]\cdot[m_{12}]\) as \([(m_{5}+m_{12})]\cdot[m_{12}]+m_{12}^{2}\). In addition, for \([m_{8}]\cdot[(m_{2}+m_{3})]\) and \([m_{5}]\cdot[m_{8}]\), we modified the computation of \(Y_{3}\) as \(m_{12}=m_{8}(m_{1}+m_{3})\) and \(Y_{3}=(m_{5}+m_{12})m_{12}+m_{12}^{2}+\beta m_{10}+Z_{3}\) without performing \([m_{5}]\cdot[m_{8}]\). Based on the proposed algorithm, Type 1 and Type 2 vulnerabilities no longer exist (Table 2).