It should be documented: - Which side-channels have been considered in the implementation. - Against which side-channel attacks the implementation is protected. - How that protection is achieved or why we believe the implementation is secure against side-channel attacks.