For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution.
Another solution is to always compute both the squared value and square-and-multiply values, and use conditional masking to select which one based on the current bit of the exponent. (For example, fill a register with a copy of the exponent bit, another register with the NOT of that bit, AND each of the two results with one of these registers, and OR those together.)
Which one is the better accepted solution? Or is a different one preferred? Thanks =^-^=