Is it okay to use a variable-time RSA implementation to verify TLS certificates?

Question

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty.

However, TLS certificate validation involves no secrets. Therefore, I should be able to use a fast variable-time algorithm for this purpose, right?

Is this actually secure, and does anyone actually do this?

OpenSSL blinds only RSA privatekey operations (decrypt and sign) precisely because the publickey doesn't need protection. And although I don't have figures I don't believe the penalty is very much: privatekey operations are much more expensive to start with, and since public exponents are usually conventional values like F4=65537 they are basically constanttime already. — dave_thompson_085, Mar 11 '16 at 9:02
TL;DR: Only signature verification involves only public information. Encryption involves a secret plaintext, signature involves a secret key and decryption involves both. — SEJPM♦, Mar 11 '16 at 11:25

gusto2 · Accepted Answer · 2016-03-11 08:47:50Z

Two answers to the question:

It is about principles and reusability of the cryptographic primitives. Once there are implemented by insecure manner, nothing prevents reusing or misusing the insecure functionality later.
TLS validation (during the SSL handshake) involves a secret as well - during the SSL handshake a piece of data is encrypted and sent over to decrypt to proof ownership of the private key. This is the part when the side-channel attack needs to be mitigated.

Carpe diem

g.

1 Answer 1