security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Code Activity

rsa: Add exponent blinding.

Browse Source 
* cipher/rsa.c (secret_core_crt): Blind secret D with randomized
nonce R for mpi_powm computation.

--

Backport of libgcrypt 8725c99ffa41778f382ca97233183bcd687bb0ce.

Signed-off-by: Marcus Brinkmann <mb@g10code.com>
This commit is contained in:
Marcus Brinkmann 2017-07-07 21:03:10 +09:00 committed by NIIBE Yutaka
parent 554ded4854
commit 8fd9f72e1b
1 changed files with 29 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
cipher/rsa.c
View File

@ -29,6 +29,7 @@
#include <string.h>
#include "util.h"
#include "mpi.h"
#include "../mpi/mpi-internal.h"
#include "cipher.h"
#include "rsa.h"
@ -325,14 +326,38 @@ secret(MPI output, MPI input, RSA_secret_key *skey )
# endif /* USE_BLINDING */
/* RSA secret operation: */
/* m1 = c ^ (d mod (p-1)) mod p */
MPI D_blind = mpi_alloc_secure (nlimbs);
MPI rr;
unsigned int rr_nbits;
rr_nbits = mpi_get_nbits (skey->p) / 4;
if (rr_nbits < 96)
rr_nbits = 96;
rr = mpi_alloc_secure ( (rr_nbits + BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB );
/* d_blind = (d mod (p-1)) + (p-1) * r */
/* m1 = c ^ d_blind mod p */
randomize_mpi (rr, rr_nbits, 0);
mpi_set_highbit (rr, rr_nbits - 1);
mpi_sub_ui( h, skey->p, 1 );
mpi_mul ( D_blind, h, rr );
mpi_fdiv_r( h, skey->d, h );
mpi_powm( m1, input, h, skey->p );
/* m2 = c ^ (d mod (q-1)) mod q */
mpi_add ( D_blind, D_blind, h );
mpi_powm ( m1, input, D_blind, skey->p );
/* d_blind = (d mod (q-1)) + (q-1) * r */
/* m2 = c ^ d_blind mod q */
randomize_mpi (rr, rr_nbits, 0);
mpi_set_highbit (rr, rr_nbits - 1);
mpi_sub_ui( h, skey->q, 1 );
mpi_mul ( D_blind, h, rr );
mpi_fdiv_r( h, skey->d, h );
mpi_powm( m2, input, h, skey->q );
mpi_add ( D_blind, D_blind, h );
mpi_powm ( m2, input, D_blind, skey->q );
mpi_free ( rr );
mpi_free ( D_blind );
/* h = u * ( m2 - m1 ) mod q */
mpi_sub( h, m2, m1 );
if ( mpi_is_neg( h ) )