Blinding ECC is as easy as RSA, if not easier. Coron's classic paper has 3 easy measures to blind a scalar multiplication, and more have appeared since then:

Blinding ECC is as easy as RSA, if not easier. Coron's classic paper has 3 easy measures to blind a scalar multiplication, and more have appeared since then: http://link.springer.com/chapter/10.1007%2F3-540-48059-5_25 http://link.springer.com/chapter/10.1007%2F3-540-48059-5_25 The problem with GnuPG is not that it's using RSA/ElGamal instead of ECC; it's that it's using a general-purpose large integer arithmetic package, MPI, whose purpose is to optimize speed for a wide range of input arguments.