# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## 5 Countermeasures  
### Countermeasures  
As for the two types of vulnerabilities considered in this paper, we introduce the following interesting properties: they make use of a single power consumption trace, yet they do not require knowledge of the inputs to the unified point addition formula for the binary Huff curve. Due to these properties, the application of classical blinding countermeasures (point blinding, scalar blinding, random projective coordinates) is not recommended. We propose new countermeasures against these vulnerabilities of unified point addition. Type 1 and Type 2 vulnerabilities are due to two problems in unified point addition on the binary Huff curve. The first is that each coordinate of input points of the unified point addition operation has the same value. This problem can be solved by using the equivalence class of projective coordinates [18]. Let \(\mathbb{F}\) be a finite field. In a binary Huff curve, the equivalence class containing \((X,Y,Z)\) is  
Figure 5: Results of the secret bit value guess by (**a**) HCCA and (**b**) ROSETTA. The blue line is the secret bit value guess and the horizontal red line is the threshold value for the secret bit value discrimination; points with a black circle indicate where the attack failed. \[(X:Y:Z)=\{(rX,rY,rZ):r\in\mathbb{F}\}. \tag{4}\]  
Notice that if \((X^{\prime},Y^{\prime},Z^{\prime})\in(X:Y:Z)\), then \((X^{\prime}:Y^{\prime}:Z^{\prime})=(X:Y:Z)\). Let \(P=(X:Y:Z)\) and \(P^{\prime}=(X^{\prime}:Y^{\prime}:Z^{\prime})\) be the equivalence class, where \(X^{\prime}=rX,Y^{\prime}=rY\), and \(Z^{\prime}=rZ\), \(r\
eq 1\). Then, \((X:Y:Z)=(X^{\prime}:Y^{\prime}:Z^{\prime})\). When considering \(P_{3}=P+P^{\prime}\) and \(P_{4}=P+P\), each coordinate of input points of \(P\) and \(P^{\prime}\) has a different value, but \(P_{3}=P_{4}\). The equivalence class has been used in random projective coordinates (RPCs), which is a countermeasure of DPA [19]. However, RPCs are generally applied only to the input \(P\) of the elliptic curve scalar multiplication. Of course, RPCs can be applied to every execution or after each unified point addition. Unfortunately, in this case, the computational cost is disadvantageously increased for RPCs. Since we only need to convert \(P\) to a different coordinate of the same equivalence class, the bit size of \(r\) need not be the same as the bit size of the finite field. Therefore, for computational efficiency, we propose a \(w\)-bit random projective coordinate (\(w\)RPC) that limits the size of \(r\) to \(w\) bits. The proposed \(w\)RPC for the binary Huff curve is depicted in Algorithm 1. ```
0:\(P=(X:Y:Z)\)
0:\(P^{\prime}=(X^{\prime}:Y^{\prime}:Z^{\prime})\)
1: Generate a \(w\)-bit random number \(r\) with \(r\
eq 1\)
2:\(X^{\prime}\gets rX\); \(Y^{\prime}\gets rY\); \(Z^{\prime}\gets rZ\)
3: return \(P^{\prime}\)
```  
**Algorithm 1**A \(w\)-bit random projective coordinate for the binary Huff curve (\(w\)RPC)  
In Algorithm 1, \(w\) is the bit size of a word multiplication for a field multiplication. In this work, we only considered the application of \(w\)RPC on a side-channel atomic algorithm using unified point addition [4]. The side-channel atomic algorithm using \(w\)RPC is described by Algorithm 2. We show the additional cost of Algorithm 2 in Section 5. ```
0:\(P=(X:Y:Z)\), \(k=(k_{n-1}...k_{0})_{2}\)
0:\(kP\gets 0\); \(R_{1}\gets P\); \(R_{2}\gets O\); \(i\gets n-1\);
2:\(k^{\prime}\gets 0\)
3:while \((i\geq 1)\) do
4:\(R_{0}\gets wRPC(R_{2})\)
5:\(R_{1}\gets wRPC(R_{1})\)
6:\(R_{2}\gets R_{2}+R_{k^{\prime}}\)
7:\(k^{\prime}\gets k^{\prime}\oplus k_{i}\)
8:\(i\gets i-\
eg k\)
9:end while
10: return \(R_{0}\)
```  
**Algorithm 2**Side-channel atomic algorithm using \(w\)RPC  
Although Algorithm 2 using unified point addition is secure against Type 1 vulnerabilities, it is still insecure against Type 2. We show in the next subsection that it is not secure against Type 2 vulnerabilities.