I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement.

Why do people avoid blinding in ECC?

• I suspect that's because blinding is not as good and makes the runtime generally longer, $\hspace{1.04 in}$ even if it seems as good and is cheaper to implement. $\;$ – user991 Apr 22 '15 at 20:38
• Actually, it's not at all true that blinding is slower; at least in the case of multiplication of the generator. If we assume 256-bit EC, then computing xG by double-and-add takes 256 doubles and 256 adds; in contrast (if we precompute the tables) a multiply by the generator might take 64 adds and no doubles (say, by radix-16; actually, there are smarter ways to do it). Even if we compute rG + (x-r)G, that brings us to 129 adds, which is still more than twice as fast as the double-and-add method. – poncho Apr 23 '15 at 15:41

Also, in the case of binary curves (curves over a field $GF(2^m)$), Montgomery's ladder (as described by López and Dahab in 1999) can be adapted to binary curve and yields a verify efficient point multiplication algorithm that is both constant-time (provided you use constant-time conditional swaps, which is no hardship) and fast (6 field multiplications per bit). It is not easy to do better than that in all generality, especially on modern x86 hardware with the CLMUL instructions (when field multiplications are slow, point-halving is better, but not when field multiplications are very fast).