Consider constant-time exponentiation instead of blinding

[mratsim]

Blinding is problematic as it ties in security with a good source of randomness (which arguably we have with a secret key input but even then).

Furthermore, even with blinding, the fact that you use branches will still leave your library exposed to fault attacks.

Lastly, there have been many de-blinding techniques in the recent years including RSA attacks on OpenSSL:

• One&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA\ Monjur Alam, Haider Adnan Khan, Moumita Dey, Nishith Sinha, Robert Callan, Alenka Zajic, and Milos Prvulovic\ https://www.usenix.org/conference/usenixsecurity18/presentation/alam
• Survey for Performance & Security Problems of Passive Side-channel Attacks Countermeasures in ECC\ Rodrigo Abarúa, Claudio Valencia, and Julio López, 2019\ https://eprint.iacr.org/2019/010

And while targeted at elliptic curve scalar multiplication, scalar multiplication and finite field exponentiation is the same algorithm so those papers are relevant as well

• One Trace Is All It Takes: Machine Learning-Based Side-Channel Attack on EdDSA Léo Weissbart, Stjepan Picek, Lejla Batina, 2019 https://eprint.iacr.org/2019/358
• Side-Channel Attacks on Blinded Scalar Multiplications Revisited Thomas Roche, Laurent Imbert, Victor Lomné https://eprint.iacr.org/2019/1220

For reference this is a constant-time exponentiation implementation: https://github.com/mratsim/constantine/blob/afb33a5/constantine/arithmetic/limbs_montgomery.nim#L449-L628