From f8afec45c659c870a3930a8e1b9cf26d6f0760d5 Mon Sep 17 00:00:00 2001 From: Jack Lloyd Date: Sun, 17 Jun 2018 11:02:32 -0400 Subject: Avoid leaking size of exponent See #1606 for discussion --- src/lib/pubkey/dsa/dsa.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/lib/pubkey/dsa') diff --git a/src/lib/pubkey/dsa/dsa.cpp b/src/lib/pubkey/dsa/dsa.cpp index 7142e4788..e43c14de2 100644 --- a/src/lib/pubkey/dsa/dsa.cpp +++ b/src/lib/pubkey/dsa/dsa.cpp @@ -42,14 +42,14 @@ DSA_PrivateKey::DSA_PrivateKey(RandomNumberGenerator& rng, else m_x = x_arg; - m_y = m_group.power_g_p(m_x); + m_y = m_group.power_g_p(m_x, m_group.q_bits()); } DSA_PrivateKey::DSA_PrivateKey(const AlgorithmIdentifier& alg_id, const secure_vector& key_bits) : DL_Scheme_PrivateKey(alg_id, key_bits, DL_Group::ANSI_X9_57) { - m_y = m_group.power_g_p(m_x); + m_y = m_group.power_g_p(m_x, m_group.q_bits()); } /* @@ -111,7 +111,7 @@ DSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len, { const BigInt& q = m_group.get_q(); - BigInt m(msg, msg_len, q.bits()); + BigInt m(msg, msg_len, m_group.q_bits()); while(m >= q) m -= q; @@ -125,7 +125,7 @@ DSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len, const BigInt k_inv = inverse_mod(k, q); - const BigInt r = m_mod_q.reduce(m_group.power_g_p(k)); + const BigInt r = m_mod_q.reduce(m_group.power_g_p(k, m_group.q_bits())); /* * Blind the input message and compute x*r+m as (x*r*b + m*b)/b -- cgit v1.2.3