Countermeasures: Masking, Blinding & Constant-Time Code
Implement masking, point blinding, and constant-time comparisons.
Countermeasures: Masking, Blinding & Constant-Time Code is a free Cryptology Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Three Families of Countermeasures
Side-channel countermeasures fall into three families: masking (randomise intermediate values), blinding (randomise inputs/outputs), and constant-time code (eliminate data-dependent timing).
Boolean Masking
XOR each intermediate with a fresh random mask r. Process masked value x⊕r and unmask at the end. The power trace now depends on x⊕r, not x.
Arithmetic Masking for Multiplications
For multiplicative operations, use multiplicative masks: replace x with x·r mod p. The masking scheme must be compatible with each algebraic operation in the cipher.
RSA Blinding
Before decrypting ciphertext c, pick random r and compute c' = c·r^e mod n. Decrypt c' to get m·r mod n, then divide out r. The actual exponentiation never sees the real c.
ECC Point Blinding
Randomise the projective coordinates: instead of affine point (x,y), use (λx : λy : λ) for random λ. The scalar multiplication operates on randomised coordinates, changing power traces each time.
Constant-Time Programming Rules
1. No secret-dependent branches. 2. No secret-dependent memory indices. 3. No early exits. 4. Use platform-intrinsic constant-time operations where available (e.g., crypto_verify_32).
Constant-Time Compare in Python
Never use == or hmac.compare_digest on raw bytes in timing-sensitive paths. Use:
import hmac
def constant_time_compare(a: bytes, b: bytes) -> bool:
"""Uses HMAC double-HMAC trick for constant-time equality."""
# hmac.compare_digest is constant-time in CPython
return hmac.compare_digest(a, b)
# Example
secret = b"expected_mac_value"
received = b"attacker_provided__"
print(constant_time_compare(secret, received)) # False, but no timing leakCompiler and Architecture Pitfalls
Compilers may optimise away constant-time code. Use volatile stores, memory barriers, or assembly intrinsics. C compilers have -fno-delete-null-pointer-checks but no universal constant-time guarantee.
Shuffling and Dummy Operations
Randomly permute the order of S-box lookups, or insert dummy operations that consume power without affecting the result. This raises the bar for DPA but does not eliminate leakage.
Hardware Countermeasures
Dedicated crypto accelerators (ARM TrustZone, STM32 hardware AES) apply masking in silicon. ASIC implementations add metal shielding and active mesh to detect physical probing.
Knowledge Check
Which countermeasure prevents RSA timing attacks by randomising the ciphertext before exponentiation?
Lesson Recap
Masking randomises intermediates; blinding randomises RSA/ECC inputs; constant-time code eliminates timing branches. Defence in depth combines all three. Hardware accelerators apply these in silicon for the strongest guarantees.
Frequently asked questions
Is the “Countermeasures: Masking, Blinding & Constant-Time Code” lesson free?
Yes — the full text of “Countermeasures: Masking, Blinding & Constant-Time Code” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.
What will I learn in “Countermeasures: Masking, Blinding & Constant-Time Code”?
Implement masking, point blinding, and constant-time comparisons. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cryptology Academy?
No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Countermeasures: Masking, Blinding & Constant-Time Code” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cryptology Academy lesson?
Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Timing Attacks: Extracting Keys from Execution Time
- Power Analysis: SPA & DPA
- Electromagnetic & Acoustic Side Channels
- Countermeasures: Masking, Blinding & Constant-Time Code