# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## Appendix A Weierstrass Elliptic Curve
### Jacobi Intersections Elliptic Curve  
An elliptic curve in Jacobi intersection form has the parameter \(a\) and coordinate \(s,c,d\) that satisfy the following equations:  
\[s^{2}+c^{2}=1\qquad as^{2}+d^{2}=1 \tag{113}\]  
The projective coordinates represent \(s,c,d\) as \(S,C,D,Z\) to satisfy the following equations:  
\[s=S/Z,\quad c=C/Z\quad\text{and}\quad d=D/Z\]  
The equivalence class containing \((S,C,D,Z)\) is  
\[(S:C:D:Z)=(\lambda S,\lambda C,\lambda D,\lambda Z):\lambda\in\mathbb{F}. \tag{114}\]  
We describe a projective form of the unified point addition formula (add-20080225-hwcd) given in [21]. Let \(P_{1}=(S_{1}:C_{1}:D_{1}:Z_{1})\) and \(P_{2}=(S_{2}:C_{2}:D_{2}:Z_{2})\); then, we get \(P_{1}+P_{2}=(S_{3}:C_{3}:D_{3}:Z_{3})\) with the unified point addition formula for the Jacobi intersection elliptic curve:  
\[\begin{cases}S_{3}=(H+F)(E+G)-J-K\\ C_{3}=(H+E)(F-G)-J+K\\ D_{3}=(B-aA)(C+D)+aJ-K\\ Z_{3}=(H+G)^{2}-2K,\end{cases} \tag{115}\]  
where  
\[\begin{array}{llll}A=S_{1}C_{1},&B=D_{1}Z_{1},&C=S_{2}C_{2},&D=D_{2}Z_{2}, \\ E=S_{1}D_{2},&F=C_{1}Z_{2},&G=D_{1}S_{2},&H=Z_{1}C_{2},\\ J=AD,&K=BC.\end{array}\]  
This formula requires 13 field multiplications and 1 field squaring. We can identify vulnerabilities of Type 1 and Type 2 during the computations of \(P_{1}+P_{2}\) for \(P_{1}\
eq P_{2}\) and \(P_{1}=P_{2}\).  
**Type 1 vulnerability:** The vulnerability of Type 1 does not exist.  
**Type 2 vulnerability:** Let us consider the computations of \(A=[S_{1}]\cdot[C_{1}]\) and \(C=[S_{2}]\cdot[C_{2}]\). If \(P_{1}=P_{2}\), then \([S_{1}]\cdot[C_{1}]\) are computed twice. Namely, the operands of \([S_{1}]\cdot[C_{1}]\) and \([S_{2}]\cdot[C_{2}]\) for \(A\) and \(B\) are the same for \(P_{1}=P_{2}\) and different for \(P_{1}\
eq P_{2}\). Similarly, consider multiplications for \(B\) and \(D\), \(E\) and \(G\), \(F\) and \(H\), and \(J\) and \(K\). These multiplication pairs have the same operandsfor \(P_{1}=P_{2}\) and different operands for \(P_{1}\
eq P_{2}\). Also, consider multiplication of \(A=[S_{1}]\cdot[C_{1}]\) and \(G=[D_{1}]\cdot[S_{1}]\). If \(P_{1}=P_{2}\), then \([S_{1}]\cdot[C_{1}]\) and \([D_{1}]\cdot[S_{1}]\) are computed. Thus, they have the same operand \(S_{1}\) when \(P_{1}=P_{2}\) but not when \(P_{1}\
eq P_{2}\). Similarly, the multiplication pairs \(A\) and \(H\), \(B\) and \(E\), \(B\) and \(F\), \(C\) and \(E\), \(C\) and \(F\), \(D\) and \(G\), and \(D\) and \(H\) have the same operand \(C_{1}\), \(D_{1}\), \(Z_{1}\), \(S_{1}\), \(C_{1}\), \(D_{1}\), and \(Z_{1}\) for \(P_{1}=P_{2}\), respectively. Therefore, we can distinguish between \(P_{1}=P_{2}\) and \(P_{1}\
eq P_{2}\) using HCCA.  
Applying \(w\)RPC to unified point addition of the Jacobi intersection elliptic curve, the two inputs are expressed as follows:  
\[\begin{cases}P_{1}=(S_{1}:C_{1}:D_{1}:Z_{1}),P_{2}=(r_{1}S_{1}:r_{1}C_{1}:r_{1 }D_{1}:r_{1}Z_{1})&\text{If }k^{\prime}=0,\\ P_{1}=(S_{1}:C_{1}:D_{1}:Z_{1}),P_{2}=(r_{2}S_{2}:r_{2}C_{2}:r_{2}D_{2}:r_{2}Z_ {2})&\text{If }k^{\prime}=1.\end{cases} \tag{10}\]  
where \(r\
eq 1\). It is sufficient to secure against a Type 2 vulnerability by applying \(w\)RPC to unified point addition. The application of \(w\)RPC to unified point addition is evaluated in Table 14. Table 14 shows that vulnerability of Type 2 no longer exists.