# Side-Channel Vulnerabilities of Unified Point Addition on Binary Huff Curve and Its Countermeasure
## 2 Preliminaries  
### Binary Huff Curve and Unified Point Addition  
At CT-RSA in 2011, a Huff curve for the binary field was proposed by [PERSON] and [PERSON]. Instead of providing general point addition, this construction provides a unified point addition operation to resist side-channel attacks. However, at CHES in 2013, [PERSON] et al. demonstrated that the unified point addition method from CT-RSA 2011 was insecure against SPA. Even though both point addition and point doubling are computed with the same formula and executed by the same sequence of finite field operations, they demand different amounts of power consumption. Specifically, point doubling with unified point addition produces a zero value in some intermediate operations. However, point addition does not. Such zero values in point doubling are used in some field multiplications in unified point addition. Apparently, the outputs are also zero. The power consumption of these multiplications with zero and nonzero inputs are significantly different. Therefore, it is possible to distinguish between point doubling and point addition. Hence, they proposed a new unified point addition formula which is secure against SPA. Here, we provide a brief description.  
**Definition 1** ([11]).: _A generalized binary Huff curve is the set of projective points \((X:Y:Z)\in\mathbb{P}^{2}(\mathbb{F}_{2^{n}})\) satisfying the equation_  
\[E/F_{2^{m}}:aX(Y^{2}+fYZ+Z^{2})=bY(X^{2}+fXZ+Z^{2}), \tag{1}\]  
_where \(a,b,f\in(F)_{2^{m}}^{*}\) and \(a\
eq b\)._  
There are three points at infinity that satisfy the curve equation, namely, \((a:b:0)\), \((1:0:0)\), and \((0:1:0)\). Let \(P_{1}=(X_{1}:Y_{1}:Z_{1})\) and \(P_{2}=(X_{2}:Y_{2}:Z_{2})\); then, we get \(P_{1}+P_{2}=(X_{3}:Y_{3}:Z_{3})\) with unified point addition [8]:  
\[\begin{cases}X_{3}=(Z_{1}Z_{2}+Y_{1}Y_{2})((X_{1}Z_{2}+X_{2}Z_{1})(Z_{1}^{2}Z_ {2}^{2}+X_{1}X_{2}Y_{1}Y_{2})+\\ \qquad\qquad\alpha X_{1}X_{2}Z_{1}Z_{2}(Z_{1}Z_{2}+Y_{1}Y_{2}))\\ Y_{3}=(Z_{1}Z_{2}+X_{1}X_{2})((Y_{1}Z_{2}+Y_{2}Z_{1})(Z_{1}^{2}Z_{2}^{2}+X_{1} X_{2}Y_{1}Y_{2})+\\ \qquad\qquad\beta Y_{1}Y_{2}Z_{1}Z_{2}(Z_{1}Z_{2}+X_{1}X_{2}))\\ Z_{3}=(Z_{1}Z_{2}+X_{1}X_{2})(Z_{1}Z_{2}+Y_{1}Y_{2})(Z_{1}^{2}Z_{2}^{2}+X_{1} X_{2}Y_{1}Y_{2}),\end{cases} \tag{2}\]  
where \(\alpha=(a+b)/b\) and \(\beta=(a+b)/a\). The unified point addition formula in Equation (2) can be evaluated as described in [9]:  
\[\begin{array}{ll}m_{1}=X_{1}X_{2},\quad m_{2}=Y_{1}Y_{2},\quad m_{3}=Z_{1}Z_ {2},\\ m_{4}=(X_{1}+Z_{1})(X_{2}+Z_{2}),\quad m_{5}=(Y_{1}+Z_{1})(Y_{2}+Z_{2}),\\ m_{6}=m_{1}m_{3},\quad m_{7}=m_{2}m_{3},\quad m_{8}=m_{1}m_{2}+m_{3}^{2},\\ m_{9}=m_{6}(m_{2}+m_{3})^{2},\,m_{10}=m_{7}(m_{1}+m_{3})^{2},\quad m_{11}=m_{8 }(m_{2}+m_{3}),\\ Z_{3}=m_{11}(m_{1}+m_{3}),\quad X_{3}=m_{4}m_{11}+\alpha m_{9}+Z_{3},\\ Y_{3}=m_{5}m_{8}(m_{1}+m_{3})+\beta m_{10}+Z_{3}.\end{array}\]  
The above operation needs 17 field multiplications, which is exactly the same as in the original one. Since point doubling does not have a zero value in any intermediate operation, it is secure against SPA. Recently, however, SCAs such as SPA using only one power consumption trace have been proposed [6; 7]. Therefore, security analysis of the unified point addition formula should be considered not only for SPA but also for other analyses. Using these analyses, we present the vulnerabilities of the unified point addition method from [9] and report our experimental results in Sections 3 and 4, respectively.