A SideChannel Attack Using Order 8 Rational Points against Curve25519 on an 8Bit Microcontroller Among the increasing evolution of IoT devices, practical applications need reliable secure protocols to communicate with each other. A major issue for modern cryptosystems is an implementation of secure and trustworthy mechanisms to rely on. A sidechannel attack against these cryptosystems may overturn the guarantee of security against conventional cyberattacks. Elliptic curve cryptography is publickey cryptography based on elliptic curves, and one of the wellknown curves is Curve25519 which is used for TLS protocols as a recommended curve. This curve is mainly implemented on limited resource devices such as microcontrollers. However, this curve poses a weakness for loworder points during a DiffieHellman key exchange is employed. This research demonstrates possible exploitation of a threat of order 8 rational points of Curve25519 and shows results of the sidechannel attacks using order 8 rational points on an embedded system. The results indicate the order 8 rational points might be applied to key extraction as attacker sides.

Stronger and Faster SideChannel Protections for CSIDH. CSIDH is a recent quantumresistant primitive based on the difficulty of finding isogeny paths between supersingular curves. Recently, two constanttime versions of CSIDH have been proposed: first by Meyer, Campos and Reith, and then by Onuki, Aikawa, Yamazaki and Takagi. While both offer protection against timing attacks and simple power consumption analysis, they are vulnerable to more powerful attacks such as fault injections. In this work, we identify and repair two oversights in these algorithms that compromised their constanttime character. By exploiting Edwards arithmetic and optimal addition chains, we produce the fastest constanttime version of CSIDH to date. We then consider the stronger attack scenario of fault injection, which is relevant for the security of CSIDH static keys in embedded hardware. We propose and evaluate a dummyfree CSIDH algorithm. While these CSIDH variants are slower, their performance is still within a small constant factor of lessprotected variants. Finally, we discuss derandomized CSIDH algorithms.