For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution.

Another solution is to always compute both the squared value and square-and-multiply values, and use conditional masking to select which one based on the current bit of the exponent. (For example, fill a register with a copy of the exponent bit, another register with the NOT of that bit, AND each of the two results with one of these registers, and OR those together.)

Which one is the better accepted solution? Or is a different one preferred? Thanks =^-^=

  • 3
    $\begingroup$ Careful, constant time operations, see BearSSL page. $\endgroup$ – kelalaka Mar 20 '19 at 22:04
  • 1
    $\begingroup$ That's a dangerous question in the sense that 1. I don't think there is a "standard" as such and 2. which is the better accepted solution is opinionated. $\endgroup$ – Maarten Bodewes Mar 21 '19 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.