Put an upper bound on the blinding value to 160 bits. This seems to be

plenty sufficient, and reduces the overhead of setting up the blinder
(in terms of exponent size and the cost of computing modular
inverses).

1 files changed, 1 insertions, 1 deletions

diff --git a/src/pubkey/elgamal/elgamal.cpp b/src/pubkey/elgamal/elgamal.cpp
index 3988f3155..837528af8 100644
--- a/src/pubkey/elgamal/elgamal.cpp
+++ b/src/pubkey/elgamal/elgamal.cpp
@@ -105,7 +105,7 @@ ElGamal_Decryption_Operation::ElGamal_Decryption_Operation(const ElGamal_Private
    powermod_x_p = Fixed_Exponent_Power_Mod(key.get_x(), p);
    mod_p = Modular_Reducer(p);
 
-   BigInt k(global_state().global_rng(), p.bits() - 1);
+   BigInt k(global_state().global_rng(), std::min<size_t>(160, p.bits() - 1));
    blinder = Blinder(k, powermod_x_p(k), p);
    }