# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## Appendix A Weierstrass Elliptic Curve  
A Weierstrass elliptic curve has the parameters \(a\) and \(b\) that satisfy the following equations:  
\[y^{2}=x^{3}+ax+b \tag{1}\]  
The projective coordinates have the assumption \(a=-3\) and represent \(x,y\) as \(X,Y,Z\) to satisfy the following equations:  
\[x=X/Z\quad\text{and}\quad y=Y/Z\]  
The equivalence class containing \((X,Y,Z)\) is  
\[(X:Y:Z)=(rX,rY,rZ):r\in\mathbb{F}. \tag{2}\]  
We describe a projective form of the unified point addition method (add-2007-bl) given in [21]. Let \(P_{1}=(X_{1}:Y_{1}:Z_{1})\) and \(P_{2}=(X_{2}:Y_{2}:Z_{2})\); then, we can get \(P_{1}+P_{2}=(X_{3}:Y_{3}:Z_{3})\) by the unified point addition formula for the Weierstrass elliptic curve:  
\[ \begin{cases}X_{3}=2 FW\\ Y_{3}=R(G-2W)-2L^{2}\\ Z_{3}=4F^{3},\end{cases}  \tag{3}\]  
where  
\[ \begin{array}{l}U_{1}=X_{1}Z_{2},\quad U_{2}=X_{2}Z_{1},\quad S_{1}=Y_{1}Z_ {2},\quad S_{2}=Y_{2}Z_{1},\\ Z=Z_{1}Z_{2},\quad T=U_{1}+U_{2},\quad M=S_{1}+S_{2},\\ R=T^{2}-U_{1}U_{2}+aZ^{2},\quad F=ZM,\quad L=MF,\end{array}  \tag{4}\] \begin{table}
\begin{tabular}{c c c c} \hline
**Curve** & **Type 1** & **Type 2** & **Countermeasures** \\ \hline Weierstrass & insecure & insecure & \(w\)RPC \\  & & & The modified unified point addition \\ \hline [PERSON] & insecure & insecure & \(w\)RPC \\ \hline [PERSON] & insecure & secure & \(w\)RPC \\  & & & \\ \hline [PERSON] & secure & insecure & \(w\)RPC \\  & & & \\ \hline [PERSON] & insecure & insecure & \(w\)RPC \\  & & & The modified unified point addition \\ \hline \end{tabular}
\end{table} 
Table 11: The vulnerabilities of the elliptic curve forms and it countermeasures. \(G=(T+L)^{2}-T^{2}-L^{2}\), and \(W=2R^{2}-G\). This formula requires 11 field multiplications and 6 field squarings. We found both Type 1 and Type 2 vulnerabilities during the computations of \(P_{1}+P_{2}\) for \(P_{1}\
eq P_{2}\) and \(P_{1}=P_{2}\). **Type 1 vulnerability**: Let us consider the computation \(Z=[Z_{1}]\cdot[Z_{2}]\). In this formula, it is computed as \([Z_{1}]\cdot[Z_{1}]\) for \(P_{1}=P_{2}\), whereas it is computed as \([Z_{1}]\cdot[Z_{2}]\) for \(P_{1}\
eq P_{2}\). Similarly, for \(U_{1}\cdot U_{2}\) in \(R\), this is computed as \([X_{1}Z_{1}]\cdot[X_{1}Z_{1}]\) for \(P_{1}=P_{2}\). Thus, we can distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using ROSETTA. **Type 2 vulnerability**: Let us consider the computations \(U_{1}=[X_{1}]\cdot[Z_{2}]\) and \(U_{2}=[X_{2}]\cdot[Z_{1}]\). If \(P_{1}=P_{2}\), then \([X_{1}]\cdot[Z_{1}]\) is computed twice. Namely, the operands of \([X_{1}]\cdot[Z_{2}]\) and \([X_{2}]\cdot[Z_{1}]\) for \(U_{1}\) and \(U_{2}\) are the same for \(P_{1}=P_{2}\) but different for \(P_{1}\
eq P_{2}\). Similarly, considering \(S_{1}=[Y_{1}]\cdot[Z_{2}]\) and \(S_{2}=[Y_{2}]\cdot[Z_{1}]\), the multiplications for \(S_{1}\) and \(S_{2}\) have the same operands for \(P_{1}=P_{2}\) but different operands for \(P_{1}\
eq P_{2}\). Therefore, we can distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using HCCCA. Applying \(w\)RPC to unified point addition on the Weierstra8 elliptic curve, the two inputs are expressed as follows:  
\[ \begin{cases}P_{1}=(X_{1}:Y_{1}:Z_{1}),P_{2}=(r_{1}X_{1}:r_{1}Y_{1}:r_{1}Z_{1} )&\text{If }k^{\prime}=0,\\ P_{1}=(X_{1}:Y_{1}:Z_{1}),P_{2}=(r_{2}X_{2}:r_{2}Y_{2}:r_{2}Z_{2})&\text{If }k^{ \prime}=1.\end{cases}  \tag{10}\]  
where \(r\
eq 1\). Although \(w\)RPC is applied to unified point addition, \(U_{1}\cdot U_{2}\) in \(R\) is computed as \([rX_{1}Z_{1}]\cdot[rX_{1}Z_{1}]\) for \(P_{1}=P_{2}\). Thus, we need to modify \(U_{1}\cdot U_{2}\) in \(R\). We modified \(R\) as follows:  
\[R = T^{2}-U_{1}U_{2}+aZ^{2}\] \[= (U_{1}+U_{2})^{2}-(U_{1}+U_{2})U_{2}+U_{2}^{2}+aZ^{2}\] \[= (U_{1}+U_{2})((U_{1}+U_{2})-U_{2})+U_{2}^{2}+aZ^{2}\] \[= TU_{1}+U_{2}^{2}+aZ^{2}\]  
After applying the above modification to unified point addition, 11 field multiplications and 6 field squarings were required, which are exactly the same as those required by the original one.