8
$\begingroup$

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, it's used in both RSA and Rabin-Williams signature schemes. This presumes integer operations are not constant time.

I have two questions:

  • Is blinding used in schemes other than integer factorization?
  • Are there other options to guard the private key against timing attacks available to software implementations on commodity hardware?

The reason I ask is Evgeny Sidorov's Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library (a.k.a. CVE-2015-2141). There was a bad interaction with the blinding value and Jacobi requirements on p, q, which resulted in a private key recovery.

One of the suggested remediations was to disable blinding. I'm trying to gauge the impact of doing it in libraries like OpenSSL and Crypto++, and how much needs to change if blinding is optional. (It is already optional in OpenSSL, but not Crypto++).

Improve this question
$\endgroup$
2
  • $\begingroup$ These links may be related to 2). $\endgroup$
    – SEJPM
    Commented Jul 25, 2015 at 11:14
  • $\begingroup$ Thanks SEJPM. That's a good point about other problems (in particular, the DH problem rather than FF problem). $\endgroup$
    – user10496
    Commented Jul 26, 2015 at 3:37

1 Answer 1

Reset to default
1
$\begingroup$

1) Blinding has been used, for example, to design a version of El Gamal encryption that is resilient to certain side-channel attacks --- see [PK] and the references therein.

2) The goal of the field of leakage-resilient cryptography is to model and study (from a theoretical perspective) what security can be guaranteed against side-channel attacks (including e.g., timing attacks). See this recent survey or this excellent blog post for more details on the type of models that are being considered.

[PK]: Pietrzak and Kiltz. Leakage Resilient ElGamal Encryption

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.