Don't use DH blinding for ephemeral DH
diff --git a/include/polarssl/dhm.h b/include/polarssl/dhm.h
index 4874bc8..09de70b 100644
--- a/include/polarssl/dhm.h
+++ b/include/polarssl/dhm.h
@@ -228,7 +228,12 @@
* \return 0 if successful, or an POLARSSL_ERR_DHM_XXX error code
*
* \note If f_rng is not NULL, it is used to blind the input as
- * countermeasure against timing attacks.
+ * countermeasure against timing attacks. This is only useful
+ * when this function is called repeatedly with the same
+ * secret value (X field), eg when using DH key exchange as
+ * opposed to DHE. It is recommended to use a non-NULL f_rng
+ * only when needed, since otherwise this countermeasure has
+ * high overhead.
*/
int dhm_calc_secret( dhm_context *ctx,
unsigned char *output, size_t *olen,