Dealing with RUSTSEC-2023-0071

[link2xt]

This decrypt public API is a straight call into rsa crate with PKCS1v15 padding:

rpgp/src/crypto/rsa.rs

Lines 25 to 33 in 63f55a7

	pub fn decrypt(priv_key: &RsaPrivateKey, mpis: &[Mpi], _fingerprint: &[u8]) -> Result<Vec<u8>> {
	// rsa consist of exactly one mpi
	ensure_eq!(mpis.len(), 1, "invalid input");
	let mpi = &mpis[0];
	let m = priv_key.decrypt(Pkcs1v15Encrypt, mpi.as_bytes())?;
	Ok(m)
	}

This is claimed to be vulnerable to timing attack at RustCrypto/RSA#19
There is a security advisory at https://rustsec.org/advisories/RUSTSEC-2023-0071 without a fix currently.

rPGP should update to fixed rsa dependency or work around this somehow, but as far as I see there is no workaround and we need an rsa crate fix.