# How can I avoid side channel attacks to scalar multiplication of Ed25519?

I'm a beginner of Edwards curve. And I'm trying to implement Ed25519 signature.There is python illustration at page 20.

At the part of scalar multiplication it simply use double and add method:

def point_mul(s, P):
Q = (0, 1, 1, 0)  # Neutral element
while s > 0:
if s & 1:
Q = point_add(Q, P)
P = point_add(P, P)
s >>= 1
return Q


Is that safe enough?

Why doesn't it use a constant time method like x25519 for DH key exchange? There is Montgomery ladder as method of scalar multiplication of X25519 for DH key exchange to prevent side channel attack. How about Ed25519?

How can I protect against side channel attack when scalar multiplication? How can I modify the function?

I will implement with hardware design after finishing the python implementation. Is there any method to prevent the attack?

• Perform dummy add when necessary. – kelalaka May 7 '19 at 19:24
• May I know more about the detail? Is there any code I can refer to? – luke May 7 '19 at 20:05
• Else T = point_add(Q, P) – kelalaka May 7 '19 at 20:08
• @kelalaka Even assuming that you manage to convince the compiler not to optimize the calculation of T whose result is not used, that only reduces the side channel, it doesn't eliminate it. The timing of code memory accesses and the branch predictor state still leak the bits of s. – Gilles 'SO- stop being evil' May 7 '19 at 23:15
• Thank you. I'm going to implement with hardware design after finishing the python code. Is it OK to simply add "else T=point_add(Q,P)" when I implement with hardware design? – luke May 8 '19 at 6:16

T = point_add(Q, P)

The select function (also called "conditional copy") selects one of the two operands depending on the value of the third, in constant time (or "side-channel silent" to be more precise). This means that you can't use branches, but just arithmetic operations. The basic idea is to compute q ^= (q ^ t) & -b where q and t are the input and b is the select bit. If it is 0, q will stay the same; if it's 1, the -b will equal to 0xFFFF... and q will be set to t. You have to be careful to use the correct data types for it to work - though since you'll implement it in hardware that will be easy to handle. Of course, you'll need to do this for every word of every number in the elliptic curve points involved. There are many examples, here is one of them.