Please forgive me if this is not the right place, however, I encountered this TLS implementation with a function that generates an ECDH key pair on an elliptic curve:
In addition to the private key and a point on the curve, the function also needs random inputs. Why and for what are the random variables required? Why isn't it just $Q=[d]G$?
It is used to implement countermeasures against side-channel attacks.
From the paper:
If f_rng is not NULL, it is used to implement countermeasures against side-channel attacks.
And
The RNG function, for blinding purposes. This may b(sic) NULL if blinding isn't needed.
See more in mbed API Documentation.
The modular inverse operation as implemented in Mbed TLS was previously vulnerable to a single-trace side channel attack. This allowed an attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to fully recover an ECDSA private key after observing a number of signature operations.
To combat these sorts of attacks, we can employ blinding; we include random data in our computations, and while the end results is independent of the random value, the intermediate values are strongly dependent, and thus the correlations between the intermediate states and anything that the attacker wants (such as the private key) is much weaker.
For further information on blinding, see
The specific attack on Mbed TLS is detailed further in this paper,
as taken from the mbed security update
There is a somewhat related follow-up from the same authors
Note PolarSSL was acquired by ARM Holdings in 2014 and As of the release of version 1.3.10, PolarSSL has been rebranded to Mbed TLS.
