so it checks for multiplication by a power of two and picks appropriate circuit.Sounds great for a timing attack.
Security is overratedNo, see the recent thread about 8chan where it was revealed that improperly secured IoT devices are causing the internet to rely on gigantic CDNs to stay online, causing a shrinking of the internet into a TV-like model of only-kosher content. Security is precisely the technique that would have prevented this sad situation. So, overrated my ass.
1. Don't store your private keys in memory.This does not affect anything. You can still have timing attacks even if you do not store them in memory.
2. Use address space randomization.Address space randomization is a useless crap that has nothing to do with timing attacks. It only kinda but not really defends against russian snowniggers using buggy programs to gain access to your computer.
This does not affect anything. You can still have timing attacks even if you do not store them in memory.They are on HDD most of the time, then getting timing right makes it hard.
Address space randomization is a useless crap that has nothing to do with timing attacksIf you don't know where the shit is and how it gets accessed, you can't time processing of it in any predictable way, because the order of say page faults and cache misses would be different for each run.
They are on HDD most of the time, then getting timing right makes it hard.I don't get what you are on about. Also, this is nothing but an assumption on your part. Ephemeral keys are used all the time for example - these are never stored on the disk, only in memory (or in the cpu cache).
If you don't know where the shit is and how it gets accessedWe do not care about that. We only care about the timing.
you can't time processing of it in any predictable wayI will just average it out.
I will just average it out.Averaging strips precision and requires large statistical base. You will have to literally DDoS the attacked machine. You will get noticed and give yourself up.
Unlike every other ALU operation, division latency/throughput is data-dependent on some CPUs. Again, this is because it's so slow and not fully pipelined. Out-of-order scheduling is easier with fixed latencies, because it avoids write-back conflicts (when the same execution port tries to produce 2 results in the same cycle, e.g. from running a 3 cycle instruction and then two 1-cycle operations).