Packed multiplication: how to amortize the cost of side-channel masking?
scientific article; zbMATH DE number 7666655