I'm a beginner at working with Edwards Curves, and I'm trying to implement an Ed25519 signature. I have a question from a text. Please see the illustration below (in Python).
At the part of scalar multiplication it simply uses the double-and-add method:
def point_mul(s, P):
Q = (0, 1, 1, 0) # Neutral element
while s > 0:
if s & 1:
Q = point_add(Q, P)
P = point_add(P, P)
s >>= 1
return Q
Is that safe enough?
Why doesn't it use a constant time method like x25519 for DH key exchange? There is the Montgomery ladder as method of scalar multiplication of X25519 for DH key exchange to prevent side channel attack. How about Ed25519?
How can I protect against side channel attack when using scalar multiplication? How can I modify the function?
I will implement with a hardware design after finishing the python implementation. Is there any method to prevent the attack?
T
whose result is not used, that only reduces the side channel, it doesn't eliminate it. The timing of code memory accesses and the branch predictor state still leak the bits ofs
. $\endgroup$