Put an upper bound on the blinding value to 160 bits. This seems to be

plenty sufficient, and reduces the overhead of setting up the blinder
(in terms of exponent size and the cost of computing modular
inverses).

4 files changed, 4 insertions, 4 deletions

diff --git a/src/pubkey/dh/dh.cpp b/src/pubkey/dh/dh.cpp
index 04941af73..956a98ba4 100644
--- a/src/pubkey/dh/dh.cpp
+++ b/src/pubkey/dh/dh.cpp
@@ -79,7 +79,7 @@ std::vector<byte> DH_PrivateKey::public_value() const
 DH_KA_Operation::DH_KA_Operation(const DH_PrivateKey& dh) :
    p(dh.group_p()), powermod_x_p(dh.get_x(), p)
    {
-   BigInt k(global_state().global_rng(), p.bits() - 1);
+   BigInt k(global_state().global_rng(), std::min<size_t>(160, p.bits() - 1));
    blinder = Blinder(k, powermod_x_p(inverse_mod(k, p)), p);
    }
 
diff --git a/src/pubkey/elgamal/elgamal.cpp b/src/pubkey/elgamal/elgamal.cpp
index 3988f3155..837528af8 100644
--- a/src/pubkey/elgamal/elgamal.cpp
+++ b/src/pubkey/elgamal/elgamal.cpp
@@ -105,7 +105,7 @@ ElGamal_Decryption_Operation::ElGamal_Decryption_Operation(const ElGamal_Private
    powermod_x_p = Fixed_Exponent_Power_Mod(key.get_x(), p);
    mod_p = Modular_Reducer(p);
 
-   BigInt k(global_state().global_rng(), p.bits() - 1);
+   BigInt k(global_state().global_rng(), std::min<size_t>(160, p.bits() - 1));
    blinder = Blinder(k, powermod_x_p(k), p);
    }
 
diff --git a/src/pubkey/rsa/rsa.cpp b/src/pubkey/rsa/rsa.cpp
index 22474d7d5..8b121f013 100644
--- a/src/pubkey/rsa/rsa.cpp
+++ b/src/pubkey/rsa/rsa.cpp
@@ -70,7 +70,7 @@ RSA_Private_Operation::RSA_Private_Operation(const RSA_PrivateKey& rsa) :
    powermod_d2_q(rsa.get_d2(), rsa.get_q()),
    mod_p(rsa.get_p())
    {
-   BigInt k(global_state().global_rng(), n.bits() - 1);
+   BigInt k(global_state().global_rng(), std::min<size_t>(160, n.bits() - 1));
    blinder = Blinder(powermod_e_n(k), inverse_mod(k, n), n);
    }
 
diff --git a/src/pubkey/rw/rw.cpp b/src/pubkey/rw/rw.cpp
index d57b967e9..11a394fad 100644
--- a/src/pubkey/rw/rw.cpp
+++ b/src/pubkey/rw/rw.cpp
@@ -77,7 +77,7 @@ RW_Signature_Operation::sign(const byte msg[], size_t msg_len,
    {
    if(!blinder.initialized())
       {
-      BigInt k(rng, n.bits() / 2);
+      BigInt k(rng, std::min<size_t>(160, n.bits() - 1));
       blinder = Blinder(power_mod(k, e, n), inverse_mod(k, n), n);
       }