CVSROOT: /cvs
Module name: src
Changes by: t...@cvs.openbsd.org 2023/04/05 05:30:12
Modified files:
lib/libcrypto/rsa: rsa_eay.c
Log message:
Set up the RSA's _method_mod_n before the initial blinding
As observed by Bernd Edlinger, the main part of the RSA timing leak that was
recently made public is that the initial blinding isn't done with Montgomery
exponentiation but rather with plain exponentiation.
Pull up the initialization of the cached Montgomery context to ensure we use
Montgomery exponentiation. Do this for private_{de,en}crypt(). Interestingly,
the latter was fixed in OpenSSL a while ago by Andy Polyakov as part of the
"smooth CRT-RSA" addition.
If this code was anything but completely insane this would never have been
an issue in the first place. But it's libcrypto...
ok jsing
