diff --git a/library/dhm.c b/library/dhm.c
index 625837e..dc815d9 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -273,51 +273,55 @@
     int ret, count;
 
     /*
-     * If Vi is initialized, update it by squaring it
+     * Don't use any blinding the first time a particular X is used,
+     * but remember it to use blinding next time.
      */
-    if( ctx->Vi.p != NULL )
+    if( mpi_cmp_mpi( &ctx->X, &ctx->_X ) != 0 )
     {
-        MPI_CHK( mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
-        MPI_CHK( mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->P ) );
-    }
-    else
-    {
-        /* Vi = random( 2, P-1 ) */
-        count = 0;
-        do
-        {
-            mpi_fill_random( &ctx->Vi, mpi_size( &ctx->P ), f_rng, p_rng );
+        MPI_CHK( mpi_copy( &ctx->_X, &ctx->X ) );
+        MPI_CHK( mpi_lset( &ctx->Vi, 1 ) );
+        MPI_CHK( mpi_lset( &ctx->Vf, 1 ) );
 
-            while( mpi_cmp_mpi( &ctx->Vi, &ctx->P ) >= 0 )
-                mpi_shift_r( &ctx->Vi, 1 );
-
-            if( count++ > 10 )
-                return( POLARSSL_ERR_MPI_NOT_ACCEPTABLE );
-        }
-        while( mpi_cmp_int( &ctx->Vi, 1 ) <= 0 );
-    }
-
-    /*
-     * If X did not change, update Vf by squaring it too
-     */
-    if( mpi_cmp_mpi( &ctx->X, &ctx->_X ) == 0 )
-    {
-        MPI_CHK( mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
-        MPI_CHK( mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->P ) );
         return( 0 );
     }
 
     /*
-     * Otherwise, compute Vf from scratch
+     * Ok, we need blinding. Can we re-use existing values?
+     * If yes, just update them by squaring them.
      */
+    if( mpi_cmp_int( &ctx->Vi, 1 ) != 0 )
+    {
+        MPI_CHK( mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
+        MPI_CHK( mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->P ) );
+
+        MPI_CHK( mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
+        MPI_CHK( mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->P ) );
+
+        return( 0 );
+    }
+
+    /*
+     * We need to generate blinding values from scratch
+     */
+
+    /* Vi = random( 2, P-1 ) */
+    count = 0;
+    do
+    {
+        mpi_fill_random( &ctx->Vi, mpi_size( &ctx->P ), f_rng, p_rng );
+
+        while( mpi_cmp_mpi( &ctx->Vi, &ctx->P ) >= 0 )
+            mpi_shift_r( &ctx->Vi, 1 );
+
+        if( count++ > 10 )
+            return( POLARSSL_ERR_MPI_NOT_ACCEPTABLE );
+    }
+    while( mpi_cmp_int( &ctx->Vi, 1 ) <= 0 );
 
     /* Vf = Vi^-X mod P */
     MPI_CHK( mpi_inv_mod( &ctx->Vf, &ctx->Vi, &ctx->P ) );
     MPI_CHK( mpi_exp_mod( &ctx->Vf, &ctx->Vf, &ctx->X, &ctx->P, &ctx->RP ) );
 
-    /* Remember secret associated with Vi and Vf */
-    MPI_CHK( mpi_copy( &ctx->_X, &ctx->X ) );;
-
 cleanup:
     return( ret );
 }