4
$\begingroup$

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty.

However, TLS certificate validation involves no secrets. Therefore, I should be able to use a fast variable-time algorithm for this purpose, right?

Is this actually secure, and does anyone actually do this?

|improve this question
$\endgroup$
  • $\begingroup$ OpenSSL blinds only RSA privatekey operations (decrypt and sign) precisely because the publickey doesn't need protection. And although I don't have figures I don't believe the penalty is very much: privatekey operations are much more expensive to start with, and since public exponents are usually conventional values like F4=65537 they are basically constanttime already. $\endgroup$ – dave_thompson_085 Mar 11 '16 at 9:02
  • $\begingroup$ TL;DR: Only signature verification involves only public information. Encryption involves a secret plaintext, signature involves a secret key and decryption involves both. $\endgroup$ – SEJPM♦ Mar 11 '16 at 11:25
2
$\begingroup$

Two answers to the question:

  • It is about principles and reusability of the cryptographic primitives. Once there are implemented by insecure manner, nothing prevents reusing or misusing the insecure functionality later.

  • TLS validation (during the SSL handshake) involves a secret as well - during the SSL handshake a piece of data is encrypted and sent over to decrypt to proof ownership of the private key. This is the part when the side-channel attack needs to be mitigated.

Carpe diem

g.

|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.