# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## 4 Experiments  
In this section, we provide experimental results showing that unified point addition on the binary Huff curve is vulnerable to HCCA and ROSETTA. For this, we implemented a field multiplication for unified point addition on the binary Huff curve on an ARM cortex-m4 processor on the ChipWhisperer CW308 UFO evaluation board [12]. The scheme of the experimental setup used for measuring the power consumption is shown in Figure 1.  
We collected a power consumption trace which is measured when 192 field multiplications are performed. We randomly selected whether the two operands of the two multiplications of each pair are identical or not for HCCA. Also, we randomly selected whether the operands of the multiplication are identical or not for ROSETTA. The power consumption trace was acquired using a Lecroy HDO oscilloscope with a sampling rate of 5 GS/s. We preprocessed the power consumption trace with a 168 MHz low-pass filter and 3-point maximum compression only for ROSETTA. Figure 2 shows a power consumption trace of field multiplications for unified point addition on the binary Huff curve. Using SPA and a cross-correlation technique, we identified each \(w\)-bit multiplication in a field multiplication and separated these into subtraces which correspond to each \(w\)-bit multiplication, as shown in Figure 3. For the experiment, we divided them into 96 pairs of subtraces of field multiplications for \((x_{1})\cdot(y_{1})\) and \((x_{2})\cdot(y_{2})\) for HCCA. Similarly, we separated a power consumption trace into subtraces of 192 field multiplications for \((x)\cdot(y)\) for ROSETTA. To perform HCCA and ROSETTA, each subtrace was classified into two groups appropriately according to each analysis method. To find a pairwise collision, we separated the subtraces into two groups based on the following fact. Since HCCA determines whether a collision occurs during two field multiplications or not, we  
Figure 1: The scheme of the experimental setup used for measuring power consumption. divided the subtraces of the \(w\)-bit multiplications \((x_{1})_{i}\cdot(y_{1})_{j}\) and \((x_{2})_{i}\cdot(y_{2})_{j}\) for all \(i,j\) of the two multiplications \((x_{1})\cdot(y_{1})\) and \((x_{2})\cdot(y_{2})\) into each group. In the case of ROSETTA, similar to HCCA, we divided the subtraces of the \(w\)-bit multiplications \((x)_{i}\cdot(y)_{j}\) and \((x)_{j}\cdot(y)_{i}\) for all \(i\
eq j\) of a field multiplication \(x\cdot y\) into each group. To find points of interest (POIs), i.e., those having the most collision-related leakage information, we calculated the sum of squared pairwise t-differences (SOST), which is [PERSON]'s \(t\)-test of two groups, using the following:  
\[\left(\frac{m_{1}-m_{2}}{\sqrt{\frac{\sigma_{1}^{2}}{n_{1}}+\frac{\sigma_{2}^ {2}}{n_{2}}}}\right)^{2} \tag{3}\]  
where \(m_{i}\) is the mean trace of group \(i\), and \(\sigma_{i}^{2}\) is the variance trace of group \(i\)[13; 14]. SOST is a tool mainly used to identify side-channel leakage and is discussed in the SCA literature [15; 16; 17]. Because SOST is computed depending on the group's statistics and each group is separated based on the  
Figure 3: Beginning of a field multiplication power consumption trace. Each \(w\)-bit multiplication subtrace in a field multiplication can be identified using simple power analysis (SPA) and cross-correlation. Figure 2: A single power consumption trace of field multiplications for binary Huff curve software implementation on an ARM cortex-m4 processor. The power consumption trace is composed of subtraces corresponding to field multiplications. operand of \(w\)-bit multiplication, points having high SOST indicate POIs. Since HCCA uses both the inputs and the output of \(w\)-bit multiplication, we selected points having a SOST value higher than some heuristic threshold. However, ROSETTA uses the output of \(w\)-bit multiplication, and we selected points having leakage of manipulating the output, considering the sequence of the multiplication.