powMod

Computes modular exponentiation: base^exp mod mod.

Uses sliding-window binary exponentiation with regular modular reduction (divMod); odd moduli take the powModOdd path, even moduli use CRT decomposition with reduction modulo 2^k.

Security: This function is NOT constant-time. The sliding window's control flow, the secret-indexed table lookups, and the value-dependent modular reductions all leak exponent bits through timing. It is safe for public exponents (RSA verification, public key derivation) but unsafe for secret exponents; secret-key operations must pair it with blinding of the base AND the exponent (see rsaDpBlinded and ddn.crypto.kex.dh), or use a fixed-width constant-time ladder once one exists.