Bounded time. If you have some operation that could leak information, like checking if a key can decrypt something, take the longest possible time and then add

Bounded time. If you have some operation that could leak information, like checking if a key can decrypt something, take the longest possible time and then add some, and only return after that time. If it takes 50 ms per request then so be it. Edit in response to sibling: Imagine it doesn't just take 1s but it also makes a clicking noise like a relay. You could still do 10000 requests/second if you install 10000 of them :-D. I wonder if for certain use cases it would be worth the trade-off, if you had proof of absolutely being side-channel free.