Constant-time programming keeps execution behavior from revealing secret-dependent values. The goal is to perform the same number and sequence of instructions or operations regardless of the input, limiting timing and other side channels. section 10.4 section 10.4.2
Timing, power consumption, and control-flow behavior can expose cryptographic secrets. Square-and-multiply performs multiplication only for exponent bits set to 1, allowing power traces or timing differences to reveal a private exponent. section 10.4.2
Montgomery powering ladder
For each exponent bit, update two registers so the algorithm performs one multiplication, one squaring, and one swap in a consistent sequence. A 1 updates R0 with R0 × R1 and R1 with R1²; a 0 reverses those destinations. The result matches square-and-multiply without exposing whether the processed bit was 0 or 1. section 10.4.2
Secret-dependent branches and array indexing are dangerous. Branchless conditional moves keep one instruction path; an experiment comparing branch-based and branchless summation shows sorted input greatly improves branch prediction for the former, while the latter remains comparatively stable. section 10.5
Apply the technique alongside broader implementation defenses:
- Avoid branching and indexing on secret values. section 10.9
- For padding validation, maximize test coverage, fuzz extensively, and use constant-time parsing when the expected plaintext is unknown. section 10.3
- Prefer generating a correctly padded reference value and comparing it with the input when the expected value is known. section 10.3
Figure 10.6 Power trace of an RSA exponentiation showing how the square-and-multiply algorithm reveals the exponent
Use the power trace to see how data-dependent square-and-multiply operations can reveal exponent bits. section 10.4.2
