When an attacker can observe leaks from secret-dependent computations, blinding adds a layer of indirection: the operation processes a randomized equivalent instead of the known value or original secret. section 13.4.2 section 13.5
Base blinding applies this idea to RSA decryption:
- Generate a random invertible factor r. section 13.4.2
- Compute message = (ciphertext × r^e)^d mod N. section 13.4.2
- Remove the factor with real_message = message × r⁻¹ mod N. section 13.4.2
Scalar blinding protects elliptic-curve operations differently: replace secret scalar d with d + k₁ × order, which produces the same point while hiding the scalar used during computation. Blinding commonly complements constant-time algorithms, masking, and other hardware or software mitigations. section 13.4.2 section 13.5
