Add back in blinding to RSA, RW, ElGamal, and DH.

There are multiple unsatisfactory elements to the current solution,
as compared to how blinding was previously done:

Firstly, blinding is only used in the baseline implementations; the code
using OpenSSL and GMP is not protected by blinding at all.

Secondly, at the point we need to set up blinding, there is no access
to a PRNG. Currently I am going with a quite nasty solution, of using
a private key parameter to seed a simple PRNG constructed as:
  SHA-512(TS1 || private_key_param || public_key_param || TS2)

I really want to fix both of these elements but I'm not sure how to do
so easily.

1 files changed, 5 insertions, 2 deletions

diff --git a/src/pubkey/rsa/rsa.cpp b/src/pubkey/rsa/rsa.cpp
index 984d030ef..2ac001a31 100644
--- a/src/pubkey/rsa/rsa.cpp
+++ b/src/pubkey/rsa/rsa.cpp
@@ -79,6 +79,8 @@ RSA_Private_Operation::RSA_Private_Operation(const RSA_PrivateKey& rsa) :
    powermod_d2_q(rsa.get_d2(), rsa.get_q()),
    mod_p(rsa.get_p())
    {
+   BigInt k = Blinder::choose_nonce(rsa.get_d(), n);
+   blinder = Blinder(power_mod(k, rsa.get_e(), n), inverse_mod(k, n), n);
    }
 
 BigInt RSA_Private_Operation::private_op(const BigInt& m) const
@@ -99,7 +101,7 @@ RSA_Private_Operation::sign(const byte msg[], u32bit msg_len,
                             RandomNumberGenerator&) const
    {
    BigInt m(msg, msg_len);
-   BigInt x = private_op(m);
+   BigInt x = blinder.unblind(private_op(blinder.blind(m)));
    return BigInt::encode_1363(x, n.bytes());
    }
 
@@ -110,7 +112,8 @@ SecureVector<byte>
 RSA_Private_Operation::decrypt(const byte msg[], u32bit msg_len) const
    {
    BigInt m(msg, msg_len);
-   return BigInt::encode(private_op(m));
+   BigInt x = blinder.unblind(private_op(blinder.blind(m)));
+   return BigInt::encode(x);
    }
 
 }