So I had the following questions regarding (twisted) Edwards / Montgomery curves over binary extension fields:
- Do they exist?
Yes[1]. They have the form $$d_1 (x + y) + d_2 (x^2 + y^2) = x y (1 + x) (1 + y)$$ where $d^2 \ne {d_1}^2 + d_1$. The identity is $(0, 0)$; negation sends $(x, y) \mapsto (y, x)$. If $d_2 \ne \alpha^2 + \alpha$ for any $\alpha$, then like (nonbinary—represent!) Edwards curves, binary Edwards curves have a relatively simple complete addition law, detailed in the EFD.
- Are they any special, like Curve25519 and Curve448 are (i.e. easy side-channel resistant implementation)?
BBE251[2] is the binary Edwards curve over the field $\mathbb F_2[t]/(t^{251} + t^7 + t^4 + t^2 + 1)$ with coefficients $$d_1 = d_2 = t^{57} + t^{54} + t^{44} + 1.$$ Like Ed448-Goldilocks, BBE251 was chosen to optimize certain performance metrics within this shape, subject to security constraints detailed in the paper; for example, the small Hamming weight and convenient shape of the polynomial $t^{251} + t^7 + t^4 + t^2 + 1$ makes reduction cheaper, and the small degree and Hamming weight of $t^{57} + t^{54} + t^{44} + 1$ makes multiplication cheaper.
The accompanying software computes a batch of thousands of scalar multiplications in somewhat fewer cycles per key on average than contemporary software for elliptic curves over prime fields of similar conjectured security levels. Even though software doesn't make fast binary field arithmetic easy, the simple complete addition laws make for easy bit slicing in batch computation.
(Side note: There's nothing particularly special about Curve25519 and Curve448 among Montgomery curves over nicely shaped prime fields that makes them encourage side channel resistance. Their equations $y^2 = x^3 + A x^2 + x$ have small coefficients $A$, which makes for a cheaper ladder, but that's a performance optimization, not a security concern. Their primes $2^{255} - 19$ and $2^{448} - 2^{224} - 1$ make for fast constant-time reduction algorithms, but it's not clear that there's any security analogy here when the premise is a bit-sliced batch algorithm anyway.)
- Are there standardized curves for them?
Not to my knowledge.
There has been relatively little interest in these curves, it seems, perhaps in part because without a batch advantage they are extremely slow to compute in constant-time software, and perhaps in part because the security of binary field curves seems shakier and not as well-understood—or at least not as confidently understood—as large prime field curves[3].
More recent performance results like [4] are heavily dependent on CPU support for binary field arithmetic, and even then it's not clear that binary Edwards curves are competitive in performance with other alternatives, particularly alternatives that take advantage of fast endomorphisms.
