For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution.

Another solution is to always compute both the squared value and square-and-multiply values, and use conditional masking to select which one based on the current bit of the exponent. (For example, fill a register with a copy of the exponent bit, another register with the NOT of that bit, AND each of the two results with one of these registers, and OR those together.)

Which one is the better accepted solution? Or is a different one preferred? Thanks =^-^=

  • 4
    $\begingroup$ Careful, constant time operations, see BearSSL page. $\endgroup$
    – kelalaka
    Mar 20, 2019 at 22:04
  • 2
    $\begingroup$ That's a dangerous question in the sense that 1. I don't think there is a "standard" as such and 2. which is the better accepted solution is opinionated. $\endgroup$
    – Maarten Bodewes
    Mar 21, 2019 at 13:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.