|
 |
564695 |
commit e8b7f10be275bcedb5fc05ed4837a89bfd605c61
|
|
|
564695 |
Author: NIIBE Yutaka <gniibe@fsij.org>
|
|
|
564695 |
Date: Tue Apr 13 10:00:00 2021 +0900
|
|
|
564695 |
|
|
|
564695 |
cipher: Hardening ElGamal by introducing exponent blinding too.
|
|
|
564695 |
|
|
|
564695 |
* cipher/elgamal.c (do_encrypt): Also do exponent blinding.
|
|
|
564695 |
|
|
|
564695 |
--
|
|
|
564695 |
|
|
|
564695 |
Base blinding had been introduced with USE_BLINDING. This patch add
|
|
|
564695 |
exponent blinding as well to mitigate side-channel attack on mpi_powm.
|
|
|
564695 |
|
|
|
564695 |
GnuPG-bug-id: 5328
|
|
|
564695 |
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
|
|
|
564695 |
|
|
|
564695 |
diff --git a/cipher/elgamal.c b/cipher/elgamal.c
|
|
|
564695 |
index 4eb52d62..9835122f 100644
|
|
|
564695 |
--- a/cipher/elgamal.c
|
|
|
564695 |
+++ b/cipher/elgamal.c
|
|
|
564695 |
@@ -522,8 +522,9 @@ do_encrypt(gcry_mpi_t a, gcry_mpi_t b, gcry_mpi_t input, ELG_public_key *pkey )
|
|
|
564695 |
static void
|
|
|
564695 |
decrypt (gcry_mpi_t output, gcry_mpi_t a, gcry_mpi_t b, ELG_secret_key *skey )
|
|
|
564695 |
{
|
|
|
564695 |
- gcry_mpi_t t1, t2, r;
|
|
|
564695 |
+ gcry_mpi_t t1, t2, r, r1, h;
|
|
|
564695 |
unsigned int nbits = mpi_get_nbits (skey->p);
|
|
|
564695 |
+ gcry_mpi_t x_blind;
|
|
|
564695 |
|
|
|
564695 |
mpi_normalize (a);
|
|
|
564695 |
mpi_normalize (b);
|
|
|
564695 |
@@ -534,20 +535,33 @@ decrypt (gcry_mpi_t output, gcry_mpi_t a, gcry_mpi_t b, ELG_secret_key *skey )
|
|
|
564695 |
|
|
|
564695 |
t2 = mpi_snew (nbits);
|
|
|
564695 |
r = mpi_new (nbits);
|
|
|
564695 |
+ r1 = mpi_new (nbits);
|
|
|
564695 |
+ h = mpi_new (nbits);
|
|
|
564695 |
+ x_blind = mpi_snew (nbits);
|
|
|
564695 |
|
|
|
564695 |
/* We need a random number of about the prime size. The random
|
|
|
564695 |
number merely needs to be unpredictable; thus we use level 0. */
|
|
|
564695 |
_gcry_mpi_randomize (r, nbits, GCRY_WEAK_RANDOM);
|
|
|
564695 |
|
|
|
564695 |
+ /* Also, exponent blinding: x_blind = x + (p-1)*r1 */
|
|
|
564695 |
+ _gcry_mpi_randomize (r1, nbits, GCRY_WEAK_RANDOM);
|
|
|
564695 |
+ mpi_set_highbit (r1, nbits - 1);
|
|
|
564695 |
+ mpi_sub_ui (h, skey->p, 1);
|
|
|
564695 |
+ mpi_mul (x_blind, h, r1);
|
|
|
564695 |
+ mpi_add (x_blind, skey->x, x_blind);
|
|
|
564695 |
+
|
|
|
564695 |
/* t1 = r^x mod p */
|
|
|
564695 |
- mpi_powm (t1, r, skey->x, skey->p);
|
|
|
564695 |
+ mpi_powm (t1, r, x_blind, skey->p);
|
|
|
564695 |
/* t2 = (a * r)^-x mod p */
|
|
|
564695 |
mpi_mulm (t2, a, r, skey->p);
|
|
|
564695 |
- mpi_powm (t2, t2, skey->x, skey->p);
|
|
|
564695 |
+ mpi_powm (t2, t2, x_blind, skey->p);
|
|
|
564695 |
mpi_invm (t2, t2, skey->p);
|
|
|
564695 |
/* t1 = (t1 * t2) mod p*/
|
|
|
564695 |
mpi_mulm (t1, t1, t2, skey->p);
|
|
|
564695 |
|
|
|
564695 |
+ mpi_free (x_blind);
|
|
|
564695 |
+ mpi_free (h);
|
|
|
564695 |
+ mpi_free (r1);
|
|
|
564695 |
mpi_free (r);
|
|
|
564695 |
mpi_free (t2);
|
|
|
564695 |
|