Is it okay to use a variable-time RSA implementation to verify TLS certificates? RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty.

However, TLS certificate validation involves no secrets.  Therefore, I should be able to use a fast variable-time algorithm for this purpose, right?

Is this actually secure, and does anyone actually do this?
Two answers to the question:


It is about principles and reusability of the cryptographic primitives. Once there are implemented by insecure manner, nothing prevents reusing or misusing the insecure functionality later.
TLS validation (during the SSL handshake) involves a secret as well - during the SSL handshake a piece of data is encrypted and sent over to decrypt to proof ownership of the private key. This is the part when the side-channel attack needs to be mitigated.


Carpe diem

g.