diff --git a/library/bignum.c b/library/bignum.c
index 4db2b10..6ac041e 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -1610,9 +1610,13 @@
     return 0;
 }
 
-int mbedtls_mpi_exp_mod_optionally_safe(mbedtls_mpi *X, const mbedtls_mpi *A,
-                                        const mbedtls_mpi *E, const mbedtls_mpi *N,
-                                        mbedtls_mpi *prec_RR, int E_public)
+/*
+ * Warning! If the parameter E_public has MBEDTLS_MPI_IS_PUBLIC as its value,
+ * this function is not constant time with respect to the exponent (parameter E).
+ */
+static int mbedtls_mpi_exp_mod_optionally_safe(mbedtls_mpi *X, const mbedtls_mpi *A,
+                                               const mbedtls_mpi *E, const mbedtls_mpi *N,
+                                               mbedtls_mpi *prec_RR, int E_public)
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
@@ -1695,15 +1699,11 @@
     {
         mbedtls_mpi_uint mm = mbedtls_mpi_core_montmul_init(N->p);
         mbedtls_mpi_core_to_mont_rep(X->p, X->p, N->p, N->n, mm, RR.p, T);
-        mbedtls_mpi_core_exp_mod_optionally_safe(X->p,
-                                                 X->p,
-                                                 N->p,
-                                                 N->n,
-                                                 E->p,
-                                                 E->n,
-                                                 RR.p,
-                                                 T,
-                                                 E_public);
+        if (E_public == MBEDTLS_MPI_IS_PUBLIC) {
+            mbedtls_mpi_core_exp_mod_unsafe(X->p, X->p, N->p, N->n, E->p, E->n, RR.p, T);
+        } else {
+            mbedtls_mpi_core_exp_mod(X->p, X->p, N->p, N->n, E->p, E->n, RR.p, T);
+        }
         mbedtls_mpi_core_from_mont_rep(X->p, X->p, N->p, N->n, mm, T);
     }
 
@@ -1735,6 +1735,13 @@
     return mbedtls_mpi_exp_mod_optionally_safe(X, A, E, N, prec_RR, MBEDTLS_MPI_IS_SECRET);
 }
 
+int mbedtls_mpi_exp_mod_unsafe(mbedtls_mpi *X, const mbedtls_mpi *A,
+                               const mbedtls_mpi *E, const mbedtls_mpi *N,
+                               mbedtls_mpi *prec_RR)
+{
+    return mbedtls_mpi_exp_mod_optionally_safe(X, A, E, N, prec_RR, MBEDTLS_MPI_IS_PUBLIC);
+}
+
 /*
  * Greatest common divisor: G = gcd(A, B)  (HAC 14.54)
  */
diff --git a/library/bignum_core.c b/library/bignum_core.c
index 518b1bd..ab6cf8f 100644
--- a/library/bignum_core.c
+++ b/library/bignum_core.c
@@ -748,6 +748,9 @@
 
 /* Exponentiation: X := A^E mod N.
  *
+ * Warning! If the parameter E_public has MBEDTLS_MPI_IS_PUBLIC as its value,
+ * this function is not constant time with respect to the exponent (parameter E).
+ *
  * A must already be in Montgomery form.
  *
  * As in other bignum functions, assume that AN_limbs and E_limbs are nonzero.
@@ -758,15 +761,15 @@
  * (The difference is that the body in our loop processes a single bit instead
  * of a full window.)
  */
-void mbedtls_mpi_core_exp_mod_optionally_safe(mbedtls_mpi_uint *X,
-                                              const mbedtls_mpi_uint *A,
-                                              const mbedtls_mpi_uint *N,
-                                              size_t AN_limbs,
-                                              const mbedtls_mpi_uint *E,
-                                              size_t E_limbs,
-                                              const mbedtls_mpi_uint *RR,
-                                              mbedtls_mpi_uint *T,
-                                              int E_public)
+static void mbedtls_mpi_core_exp_mod_optionally_safe(mbedtls_mpi_uint *X,
+                                                     const mbedtls_mpi_uint *A,
+                                                     const mbedtls_mpi_uint *N,
+                                                     size_t AN_limbs,
+                                                     const mbedtls_mpi_uint *E,
+                                                     size_t E_limbs,
+                                                     const mbedtls_mpi_uint *RR,
+                                                     mbedtls_mpi_uint *T,
+                                                     int E_public)
 {
     const size_t wsize = exp_mod_get_window_size(E_limbs * biL);
     const size_t welem = ((size_t) 1) << wsize;
@@ -872,6 +875,24 @@
                                              MBEDTLS_MPI_IS_SECRET);
 }
 
+void mbedtls_mpi_core_exp_mod_unsafe(mbedtls_mpi_uint *X,
+                                     const mbedtls_mpi_uint *A,
+                                     const mbedtls_mpi_uint *N, size_t AN_limbs,
+                                     const mbedtls_mpi_uint *E, size_t E_limbs,
+                                     const mbedtls_mpi_uint *RR,
+                                     mbedtls_mpi_uint *T)
+{
+    mbedtls_mpi_core_exp_mod_optionally_safe(X,
+                                             A,
+                                             N,
+                                             AN_limbs,
+                                             E,
+                                             E_limbs,
+                                             RR,
+                                             T,
+                                             MBEDTLS_MPI_IS_PUBLIC);
+}
+
 mbedtls_mpi_uint mbedtls_mpi_core_sub_int(mbedtls_mpi_uint *X,
                                           const mbedtls_mpi_uint *A,
                                           mbedtls_mpi_uint c,  /* doubles as carry */
diff --git a/library/bignum_core.h b/library/bignum_core.h
index c63cdee..d208daf 100644
--- a/library/bignum_core.h
+++ b/library/bignum_core.h
@@ -608,6 +608,8 @@
  * \brief            Perform a modular exponentiation with public or secret exponent:
  *                   X = A^E mod N, where \p A is already in Montgomery form.
  *
+ * \warning          This function is not constant time with respect to \p E (the exponent).
+ *
  * \p X may be aliased to \p A, but not to \p RR or \p E, even if \p E_limbs ==
  * \p AN_limbs.
  *
@@ -630,17 +632,13 @@
  *                   It is up to the caller to zeroize \p T when it is no
  *                   longer needed, and before freeing it if it was dynamically
  *                   allocated.
- * \param[in] E_public Set to MBEDTLS_MPI_IS_PUBLIC to gain some performance
- *                   when the value of E is public.
- *                   Set to MBEDTLS_MPI_IS_SECRET when the value of E is secret.
  */
-void mbedtls_mpi_core_exp_mod_optionally_safe(mbedtls_mpi_uint *X,
-                                              const mbedtls_mpi_uint *A,
-                                              const mbedtls_mpi_uint *N, size_t AN_limbs,
-                                              const mbedtls_mpi_uint *E, size_t E_limbs,
-                                              const mbedtls_mpi_uint *RR,
-                                              mbedtls_mpi_uint *T,
-                                              int E_public);
+void mbedtls_mpi_core_exp_mod_unsafe(mbedtls_mpi_uint *X,
+                                     const mbedtls_mpi_uint *A,
+                                     const mbedtls_mpi_uint *N, size_t AN_limbs,
+                                     const mbedtls_mpi_uint *E, size_t E_limbs,
+                                     const mbedtls_mpi_uint *RR,
+                                     mbedtls_mpi_uint *T);
 
 /**
  * \brief            Perform a modular exponentiation with secret exponent: