Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?

share|improve this question
3  
1) Blind RSA signatures 2) Avoiding certain side-channel attacks by working on blinded data –  CodesInChaos Jan 9 '13 at 10:32
    
You might want to review Blinding and www.riscure.com/benzine/documents/rsacc_ctrsa_final.pdf –  Amzoti Jan 10 '13 at 16:33

1 Answer 1

As @CodesInChaos explains:

  • It might refer to blind signatures.

  • It also might refer to a method to harden (typically) RSA implementations against timing/side-channel attacks, by blinding the data before operating on it.

    Example: suppose you are writing code to decrypt data, i.e., to compute $y=x^d \bmod n$, given the input $x$. The naive way to do is just to compute $x^d \bmod n$; but it turns out this can be vulnerable to timing and other side-channel attacks. One defense is to blind the data before raising the $d$th power. In more detail, pick a random number $r$; compute $s=r^e \bmod n$; compute $X=xs \bmod n$ and then $Y=X^d \bmod n$ and then $y=Y/r \bmod n$. You can notice that $Y/r=X^d/r=(xs)^d/r = x^d s^d/r = x^d r/r = x^d \bmod n$, which is what we wanted to compute. However, this process makes it hard for an attacker to learn anything about $d$ using a timing attack, because the exponentiation process works on a random value $X$ that's not known to the attacker, rather than on the known value $x$.

share|improve this answer
    
Then again, it is usually not the value $x$ to-be-raised that has to be blinded, but the private exponent $d$. Your method does not blind $d$, so if the timing attack works independently of the value-to-be-raised, it has no effect at all. –  Henrick Hellström Mar 2 '13 at 10:40
    
@HenrickHellström, the defense I have described (namely, blinding $x$) is a standard defense against timing attacks on RSA. To my knowledge, this method of blinding defends against all known timing attacks against RSA (i.e., against all attacks that are capable of recovering $d$). I do not know of any timing attack that works if $x$ is blinded in this way (i.e., any timing attack that can recover $d$ without knowledge of the value-to-be-raised). If you know of anything that contradicts this, I'd certainly be interested to hear. –  D.W. Mar 2 '13 at 11:14
    
I describe it informally in my answer to this question: crypto.stackexchange.com/questions/6538/…. Basically, if you are targeting e.g. a server that performs the private key operation using CPU operations, you make it (or observe it) perform other tasks at different relative timing offsets to the start of the private key operation to be attacked. For most exponentiation implementations this will reveal each bit of the private exponent with an accuracy that depends only on how accurate the timing is. –  Henrick Hellström Mar 2 '13 at 11:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.