I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves.
That section claims that in order to thwart invalid curve attacks an efficient technique is to use a single coordinate ladder to compute the scalar multiplication. Then the section goes on in describing twists and explicitly refers to Montgomery Curves, particularly when it says "The Montgomery ladder formulas for $By^2=x^3+Ax^2+x$ also compute scalar multiplication for the twisted curve $(B/u)y^2=x^3+Ax^2+x$".
Now, I understand this is a problem because during an ECDH, implemented with a single coordinate ladder on a Montgomery curve, I can provide a public key on the curve's twist and, if the twist's order is "weak", gain information on the other peer's private key.
But, does this apply to short Weierstrass curves ? If so, how ?
It is my understanding that a nontrivial quadratic twists on a Weierstrass curve has the form $y^2=x^3+c^2ax +c^3b$ where $c$ is a non-square in $F_p$. So the twist modifies both $a$ and $b$ parameter of the curves. For the attack to work I would assume that it is required to have a scalar multiplication ladder that works on both curves (normal and twisted). Is this assumption correct ?
Does such a ladder exists for short Weierstrass curves ?
As far as I know all $x$-coordinate only ladders for short Weierstrass make use of $a$ and $b$ in the computation, such as the one of Brier and Joye. How could this work on the twist which as different values for $a$ and $b$ ?
I'm asking this question because if such an algorithm doesn't exist, then I don't see how to apply the measure of twist security to short Weierstrass curves such as NIST P-224 and brainpoolP256t1 as djb did on that page.