Deconstify PK_Ops. It's quite reasonable that some op will want to

precompute only as needed, or will want to access some other expensive
resource or etc.

Change how the secret for generating blinding is done in cases where a
PRNG isn't available. Use the operations public op to hide the secret,
for instance the seed for a DH blinding variable is 2^x mod p.

Make use of being able to mutate internal structures in the RW signer,
since that does have access to a PRNG, so use it to initialize the
blinder on first call to sign().

2 files changed, 3 insertions, 3 deletions

diff --git a/src/pubkey/dh/dh.cpp b/src/pubkey/dh/dh.cpp
index a99506250..b491be7bc 100644
--- a/src/pubkey/dh/dh.cpp
+++ b/src/pubkey/dh/dh.cpp
@@ -78,11 +78,11 @@ MemoryVector<byte> DH_PrivateKey::public_value() const
 DH_KA_Operation::DH_KA_Operation(const DH_PrivateKey& dh) :
    p(dh.group_p()), powermod_x_p(dh.get_x(), p)
    {
-   BigInt k = Blinder::choose_nonce(dh.get_x(), p);
+   BigInt k = Blinder::choose_nonce(powermod_x_p(2), p);
    blinder = Blinder(k, powermod_x_p(inverse_mod(k, p)), p);
    }
 
-SecureVector<byte> DH_KA_Operation::agree(const byte w[], u32bit w_len) const
+SecureVector<byte> DH_KA_Operation::agree(const byte w[], u32bit w_len)
    {
    BigInt input = BigInt::decode(w, w_len);
 
diff --git a/src/pubkey/dh/dh.h b/src/pubkey/dh/dh.h
index 0cc2aaabc..738b3f9c4 100644
--- a/src/pubkey/dh/dh.h
+++ b/src/pubkey/dh/dh.h
@@ -80,7 +80,7 @@ class BOTAN_DLL DH_KA_Operation : public PK_Ops::Key_Agreement
    public:
       DH_KA_Operation(const DH_PrivateKey& key);
 
-      SecureVector<byte> agree(const byte w[], u32bit w_len) const;
+      SecureVector<byte> agree(const byte w[], u32bit w_len);
    private:
       const BigInt& p;