Deconstify PK_Ops. It's quite reasonable that some op will want to

precompute only as needed, or will want to access some other expensive
resource or etc.

Change how the secret for generating blinding is done in cases where a
PRNG isn't available. Use the operations public op to hide the secret,
for instance the seed for a DH blinding variable is 2^x mod p.

Make use of being able to mutate internal structures in the RW signer,
since that does have access to a PRNG, so use it to initialize the
blinder on first call to sign().

1 files changed, 3 insertions, 3 deletions

diff --git a/src/pubkey/elgamal/elgamal.cpp b/src/pubkey/elgamal/elgamal.cpp
index f55aeaa4c..b9c4803f3 100644
--- a/src/pubkey/elgamal/elgamal.cpp
+++ b/src/pubkey/elgamal/elgamal.cpp
@@ -91,7 +91,7 @@ ElGamal_Encryption_Operation::ElGamal_Encryption_Operation(const ElGamal_PublicK
 
 SecureVector<byte>
 ElGamal_Encryption_Operation::encrypt(const byte msg[], u32bit msg_len,
-                                      RandomNumberGenerator& rng) const
+                                      RandomNumberGenerator& rng)
    {
    const BigInt& p = mod_p.get_modulus();
 
@@ -118,12 +118,12 @@ ElGamal_Decryption_Operation::ElGamal_Decryption_Operation(const ElGamal_Private
    powermod_x_p = Fixed_Exponent_Power_Mod(key.get_x(), p);
    mod_p = Modular_Reducer(p);
 
-   BigInt k = Blinder::choose_nonce(key.get_x(), p);
+   BigInt k = Blinder::choose_nonce(powermod_x_p(2), p);
    blinder = Blinder(k, powermod_x_p(k), p);
    }
 
 SecureVector<byte>
-ElGamal_Decryption_Operation::decrypt(const byte msg[], u32bit msg_len) const
+ElGamal_Decryption_Operation::decrypt(const byte msg[], u32bit msg_len)
    {
    const BigInt& p = mod_p.get_modulus();