On: ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels

[nullc]

> - No data-dependent branches. > - No data-dependent indexing.

These are implementation properties not properties of the curve. 25519 is a fine set of parameters but it always disappoints me to see this conflation.

The implementations being attacked here were grotesquely sidechannel vulnerable. There are grotesquely sidechannel vulnerable ed25519 implementations (esp. parties that have been bitten by the 'tutorial to ecc' bug and implemented it themselves; or are otherwise reusing the verification multi-exp for signing)... and there are implementation of other things which are not vulnerable.

[tptacek → nullc]

Really? Do you have links to vulnerable Ed25519 implementations? I absolutely believe you; I'm just interested in them for exercises.

[nullc → tptacek]

For example: https://github.com/vbuterin/ed25519/blob/master/ed25519.py#L...

[tptacek → nullc]

Thanks!