Nikos Mavrogiannopoulos <[email protected]> writes:

> I've checked the patch, and it seems to use mpz_powm_sec() in the
> blinding part (which uses only public parameters). Is that
> intentional? 

Kind-of, I wasn't sure what to do here, but since the number r should
be considered secret, it seemed safest.

Let me first recap my understanding if RSA blinding (which I find a bit
questionable). When computing m^d (mod n), the point of blinding is to
obscure the bits of m, not the bits if d. It adds no protection against
side-channel attacks directly on the exponent bits, since they're the
same before and after blinding. The point of blinding is instead to
defend against attacks exploiting side-channnel leaks in the mod p
reduction code, which typically depend on a chosen-ciphertect attack
scenario or similar, where m is carefully chosen by the attacker. Do you
agree?

Since the secret value r goes into the input that blinding tries to
obscure, using powm_sec makes sme sense to me, even if it may be
overkill.

Now, in recent GMP versions, powm_sec uses a reduction method which is
intended to be side-channel silent. So when using it, blinding is
perhaps not adding any benefit at all. But I think it's best to
nevertheless keep RSA-bliding for now, as a belt-and-suspenders measure.
And because I'd prefer not to have to think of the PR issues when
deleting a established security feature...

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.
_______________________________________________
nettle-bugs mailing list
[email protected]
http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs

Reply via email to