I‘ve recently tried implementing the Noise protocol on a 7.8 MHz 68000, while it runs in 10 seconds I don’t think there is a way to make it constant time without using addition and running an order of magnitude more slowly :(

MULU operations are not constant time but depend on popcount. That has an easy work around just also do the MULU of the bitwise inverse, both instructions sum to a constant cycle count.

The brick wall I hit is related to the Macintosh SE ram being shared between CPU and video system. Every few cycles the CPU stalls instruction fetching, which turns the both MULUs together take the same amount of time each time into there is slowdown depending on the popcount of the first instruction.

I don’t know if anyone has any solution for this, there is prefetching of one instruction so all should be well, but it seems like the cpu stalls the in progress instruction if the prefetch is stalled.