I'm a beginner of Edwards curve. And I'm trying to implement Ed25519 signature.There is python illustration at page 20.
At the part of scalar multiplication it simply use double and add method:
def point_mul(s, P): Q = (0, 1, 1, 0) # Neutral element while s > 0: if s & 1: Q = point_add(Q, P) P = point_add(P, P) s >>= 1 return Q
Is that safe enough?
Why doesn't it use a constant time method like x25519 for DH key exchange? There is Montgomery ladder as method of scalar multiplication of X25519 for DH key exchange to prevent side channel attack. How about Ed25519?
How can I protect against side channel attack when scalar multiplication? How can I modify the function?
I will implement with hardware design after finishing the python implementation. Is there any method to prevent the attack?