Timeline for Deterministic RSA blinding
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 10, 2017 at 8:58 | vote | accept | Gilles 'SO- stop being evil' | ||
| Oct 5, 2017 at 16:00 | comment | added | Gilles 'SO- stop being evil' |
@fgrieu The RSA private key operation (exponentiation or using CRT parameters) must be deterministic and purely functional. It only takes the key and message as parameters and may not access global variables or perform input/output. The higher-level function rsa_sign takes an additional parameter rng_state which the caller must initialize from good entropy, that's why padding works fine but blinding is a problem. As an engineering problem, I have a workaround anyway, but I want to know whether I can implement RSA with useful blinding under these constraints.
|
|
| Oct 5, 2017 at 15:41 | comment | added | fgrieu♦ | Does "I don't have access to an entropy source" also mean that you do not have access to half-decent PRNG expected to give different results form one call to the other (without relying on message and key)? What about making such PRNG using some remanent memory (EEPROM, Flash..) rendered tear proof the usual (and hard) way? | |
| Oct 5, 2017 at 15:28 | answer | added | Lery | timeline score: 5 | |
| Oct 1, 2017 at 8:51 | comment | added | user27950 | One caveat. If you access the key for your prng, you may introduce another side channel. | |
| Sep 27, 2017 at 20:03 | history | tweeted | twitter.com/StackCrypto/status/913131912742494208 | ||
| Sep 27, 2017 at 17:00 | history | asked | Gilles 'SO- stop being evil' | CC BY-SA 3.0 |