In C, multiplication in the field $\operatorname{GF}(2^8)$ with reduction polynomial $x^8+x^4+x^3+x+1$ can go (two functionally equivalent versions): ~~~ #include <stdint.h> // bring type uint8_t used for a field element uint8_t mult1B_compact(uint8_t a, uint8_t b) { uint8_t r = 0, i = 8; while(i) r = (-(b>>--i & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); return r; } uint8_t mult1B_fast(uint8_t a, uint8_t b) { uint8_t r; r = (-(b>>7 ) & a); r = (-(b>>6 & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); r = (-(b>>5 & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); r = (-(b>>4 & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); r = (-(b>>3 & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); r = (-(b>>2 & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); r = (-(b>>1 & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); return (-(b & 1) & a) ^ (-(r>>7) & 0x1B) ^ (r+r); } ~~~ This code extensively uses a generic technique, applicable to many other languages: it moves a desired bit to the low-order bit of a byte using right-shift `>>`, isolates it with `& 1` if necessary, applies the [unary][1] operator `-` to change `1` to `0xFF…FF` (leaving `0`unchanged), then uses the outcome as a byte [mask][2]. For most platforms, this is constant time. I know no exception, but still that should be checked, e.g. by inspection of the generated code, and in theory invoking/verifying considerations about what influences the execution time of an instruction on each of the target CPUs. On many platforms, `mult1B_fast` (perhaps, made `inline`) is next to the fastest portable constant-time code. However, when there is no barrel shifter (that is, when large shift count slows down things) there may be better options. Note: This technique leaves other side channels wide open, in particular power analysis. Note: demonstrating constant-timeness is very difficult in some non-compiled languages. For example, the most minute details about the runtime environment in theory needs to be taken into account; like, what heuristic a Java [JITC][3] uses. Note: Silence any bogus compiler/tool warning on the tune of _unary minus operator applied to unsigned type, result still unsigned_, perhaps by changing the occurrences of `-(` to `0-(`. Add parenthesis to satisfy any required convention. [1]: https://en.wikipedia.org/wiki/Unary_operation [2]: https://en.wikipedia.org/wiki/Mask_(computing) [3]: https://en.wikipedia.org/wiki/Just-in-time_compilation