I'm trying to understand the security of the Montgomery ladder algorithm in the context of timing side-channel attacks. I'm looking at the algorithm from wikipedia
While I know that the algorithm ensures a constant number of operations in each branch of the if statement, I'm unsure about its overall safety. The Montgomery ladder iterates over all bits of a secret scalar, which makes me question its vulnerability to timing-based attacks.
I understand that the key insight of the Montgomery ladder is that it performs the same sequence of operations regardless of whether the corresponding bit of the scalar is 0 or 1. This property ensures that the timing behavior of the algorithm does not depend on the value of the secret scalar.
However, constant-time programming advises against using if statements with secret conditions. However, in the case of the Montgomery ladder, we iterate over the bits of the scalar, which is a secret. Doesn't this pose a potential security risk?