# Why do Edwards curves protect against side-channel attacks?

From Wikipedia:

One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel attack.

Could you explain with more detail how an explicit doubling can protect against side-channel attacks?

• I believe the passage was saying that because there is only one formula for both addition and doubling. If you have a constant time addition formula, you also have a constant time doubling formula. The alternative would be that you would need to make sure that both addition and doubling are constant time
– user69644
Jul 17 '19 at 20:53

Some formulas like the usual short Weierstrass addition formula for curves over fields of characteristic $${>}3$$, involve terms like $$\frac{y(P) - y(Q)}{x(P) - x(Q)}$$ which don't work when $$P = Q$$. So to reliably add two points, you have to write logic like:

if P == Q:
return doubling_formula(P)
else:

This conditional may take a different amount of time depending on potentially secret points $$P$$ and $$Q$$. Even if doubling_formula and addition_formula take exactly the same amount of time, the machine may take a different amount of time depending on which way the branch goes because it may predict one way and take more time if the prediction is wrong, or it may have different effects on CPU caches depending on which branch is taken. In general, CPUs do not keep branch conditions secret.
One way to do this is to compute both doubling_formula(P) and addition_formula(P, Q) and then choose between them with arithmetic like (d & m) | (a & ~m) where d is the outcome of doubling, a is the outcome of addition, and m is all 1 bits if $$P = Q$$ and all 0 bits if $$P \ne Q$$. But this costs more to compute because now you have to compute the addition formula and the doubling formula, even if you're going to use the result of only one of them, whenever you want to add two points.
The Edwards addition formula, in contrast, does not have any such terms, and it works for all pairs of points, even if $$P = Q$$. Consequently you don't need to write conditionals and you don't need to spend the cost of computing multiple different formulas. But it only works for some curves like edwards25519; it doesn't work for, e.g., secp256k1.
• Mathematically there are two special cases: $P = Q$ (use doubling) and $P = -Q$ (result 'zero'). But the latter case doesn't occur in X9.62-type signature, because we multiply $G$ by a number less than its order. Aug 25 '19 at 7:52