[Cfrg] Side Channel Attacks Against Curve25519

[Thomas Garcia <[e-mail]>]

Hello,
According to [1], the libgcrypt implementation of curve25519 is based on
bignum arithmetic which is not constant-time. A similar issue was raised in
[2], regarding the Go implementation. [1] proposed solving this by
rejecting small order inputs. But this recommendation is problematic [3].
As this issue seems to come up once in a while, I think it should be
addressed. Good crypto should encourage proper implementation, in the sense
that the simplest way of implementing it is the correct way (which isn't
vulnerable to side channel attacks). Curve25519 was developed in accordance
with that philosophy and the addition formulas are well implemented. Can
something similar be done to encourage correct bignum arithmetic? Is it
possible to choose the parameters, such as the prime, such that the
simplest implementation will be less susceptible to side channel attacks?
What I imagine is a prime which would normally have long computation times,
but has a trick that enables simpler addition which is coincidentally
constant time.

Thanks,
Thomas G.

[1] - https://eprint.iacr.org/2017/806
[2] - https://moderncrypto.org/mail-archive/curves/2017/000930.html
[3] - https://twitter.com/hashbreaker/status/902415565435830273