According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time.

I am wondering

  1. why this is the case
  2. if this is true for all Brainpool curves (in particular P256r1 and P512r1)

This has already partly been discussed in this answer, but no reason was stated there.

  • 2
    $\begingroup$ What can be confusing is that "Montgomery ladder" can also refer to a generic algorithm which does work for Brainpool curves or any other curve $\endgroup$
    – Conrado
    May 14, 2021 at 13:18
  • $\begingroup$ Thank you. After reading that paper, I was obviously mistaken. What I assumed to be the Montgomery ladder ist actually the generic algorithm by Joye. $\endgroup$
    – mat
    May 14, 2021 at 13:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.