The RSA blinding patch seems to cause problems when the same RSA
private key is used simultaneously in multiple threads.
I believe this is caused by the call to BN_BLINDING_update in
BN_BLINDING_invert. If one thread finishes an RSA decryption
and calls BN_BLINDING_invert while another thread is in between
the BN_BLINDING_convert and BN_BLINDING_invert calls, then the
second thread will "unblind" with the wrong value.
I would suggest something along the lines of:
- move the BN_BLINDING_update into BN_BLINDING_convert.
- make BN_BLINDING_convert hand the unblinding value
(Ai) back to the caller for subsequent use.
- place a lock around this logic in BN_BLINDING_convert
so that the steps of blinding, capturing the unblinding
value, and updating are an atomic operation.
If no one beats me to submitting a patch next week, I'll try to
write one up and send it in.
Tom
--
Tom Wu * finger -l [EMAIL PROTECTED] for PGP key *
E-mail: [EMAIL PROTECTED] "Those who would give up their freedoms in
Phone: (650) 723-1565 exchange for security deserve neither."
http://www-cs-students.stanford.edu/~tjw/ http://srp.stanford.edu/
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
