elliptic-curve-scalar-blind-gate

Answer

Done. I created and verified a working solution.

Files

• ~/SOLUTION.md — self-contained writeup: title, root-cause analysis, exact fix (full code), and verification.
• ~/ec-scalar-blind-gate.js — the runnable, verified implementation.

Diagnosis (root cause)

The classic binary double-and-add leaks through a conditional addition (if (bit) add(...)), so the number of additions equals the scalar's Hamming weight. I demonstrated this concretely:

1      doubles=256 adds=1   traceLen=257
2^255  doubles=256 adds=1   traceLen=257
full   doubles=256 adds=256 traceLen=512
n-1    doubles=256 adds=191 traceLen=447

Skipping zero windows in a fixed-window ladder reintroduces the same leak at nibble granularity, and secret-indexed table access leaks the digit too.

The fix

1. Process a fixed 64 nibbles (256 bits) — no leading-zero trimming/early exit.
2. For every window select a table entry and call add; a zero digit selects the identity, giving a dummy addition.
3. Constant-time table select scanning all 16 entries with bit masks.
4. Jacobian coordinates + fixed-exponent Fermat inversion for speed and data-independent op sequence.

Result: exactly 64 × (4 doublings + 1 addition) = 320 operations for every scalar.

Verification

node ec-scalar-blind-gate.js → ALL TESTS PASSED in ~3s:

• 1000 random scalars match the independent binary reference.
• Scalars with Hamming weights 1, 1, 2, 3, 256, 191 produce the identical 320-symbol trace string.
• N·G = ∞, 1·G = G, 2·G = double(G) sanity checks pass.

The writeup also notes the honest caveat: JS BigInt isn't a true hardware constant-time primitive, so this guarantees operation-sequence independence (the property tested) rather than wall-clock timing.