Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes integer operations are not constant time.

I have two questions:

  • Is blinding used in schemes other than integer factorization?
  • Are there other options to guard the private key from timing attacks available to software implementations on commodity hardware?

The reason I ask is Evgeny Sidorov's Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library (a.k.a. CVE-2015-2141). There was a bad interaction with the blinding value and Jacobi requirements on p, q, which resulted in a private key recovery.

One of the suggested remediations was to disable blinding. I'm trying to gauge the impact of doing it in libraries like OpenSSL and Crypto++, and how much needs to change if blinding is optional. (Its already optional in OpenSSL, but not Crypto++).

  • $\begingroup$ These links may be related to 2). $\endgroup$ – SEJPM Jul 25 '15 at 11:14
  • $\begingroup$ Thanks SEJPM. That's a good point about other problems (in particular, the DH problem rather than FF problem). $\endgroup$ – jww Jul 26 '15 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.