well, yes. if you’re an NSA-level actor your AES implementation hasn’t been `AES_encode(key, input)`, but `AES_encode(key, input, random)`. you then XOR the ran

well, yes. if you’re an NSA-level actor your AES implementation hasn’t been `AES_encode(key, input)`, but `AES_encode(key, input, random)`. you then XOR the randomness into the input, do all your (modified) AES operations, and then XOR the randomness out [1]. the modified AES operations take about double the area/power because your “input” is effectively twice as long as it used to be, but there’s now next to zero correlation between input/key and power use. like most things, i expect the reason they’re not adopted for consumer devices is because they use notably more power/area/are slower. [1] enter "Provably Secure Masking of AES" into scihub and you'll find a useful paper by Blömer, Merchan and Krummel from 2004.