Skip to content

Problematic blinding in RSA #652

@Fethbita

Description

@Fethbita

Currently, the blind function performs the following lines:

    let mut r: BoxedUint = BoxedUint::one_with_precision(bits);
    let mut ir: Option<BoxedUint> = None;
    while ir.is_none() {
        r = BoxedUint::try_random_mod_vartime(rng, key.n()).map_err(|_| Error::Rng)?;
        if r.is_zero().into() {
            r = BoxedUint::one_with_precision(bits);
        }

        // r^-1 (mod n)
        ir = r.invert_mod(key.n()).into();
    }

However this loop will never run multiple times because r is set to 1, instead of being set to 0 so that the invert_mod would fail. My suggestion is to set r to 0 and remove the if conditional, then the loop would go on until a proper value is found.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions