Add configuration options for verification and blinding
This commit defines some configuration options to control the
mandatory use of blinding and verification in RSA private key
operations.
diff --git a/include/mbedtls/rsa.h b/include/mbedtls/rsa.h
index 54653df..e34fea0 100644
--- a/include/mbedtls/rsa.h
+++ b/include/mbedtls/rsa.h
@@ -64,6 +64,15 @@
#define MBEDTLS_RSA_SALT_LEN_ANY -1
/*
+ * RSA configuration
+ */
+#if defined(MBEDTLS_RSA_FORCE_VERIFICATION) || \
+ ( ! defined(MBEDTLS_RSA_NO_CRT) && \
+ defined(MBEDTLS_RSA_FORCE_CRT_VERIFICATION ) )
+#define MBEDTLS_RSA_REQUIRE_VERIFICATION
+#endif
+
+/*
* The above constants may be used even if the RSA module is compile out,
* eg for alternative (PKCS#11) RSA implemenations in the PK layers.
*/
@@ -220,7 +229,7 @@
* \brief Do an RSA private key operation
*
* \param ctx RSA context
- * \param f_rng RNG function (Needed for blinding)
+ * \param f_rng RNG function (used for blinding)
* \param p_rng RNG parameter
* \param input input buffer
* \param output output buffer
@@ -229,6 +238,30 @@
*
* \note The input and output buffers must be large
* enough (eg. 128 bytes if RSA-1024 is used).
+ *
+ * \note Enabling and disabling of blinding:
+ * - If f_rng is NULL and MBEDTLS_RSA_FORCE_BLINDING
+ * is disabled, blinding is disabled.
+ * - If f_rng is NULL and MBEDTLS_RSA_FORCE_BLINDING
+ * is enabled, the function fails.
+ *
+ * \note If blinding is used, both the base of exponentation
+ * and the exponent are blinded, preventing both statistical
+ * timing and power analysis attacks.
+ *
+ * \note Depending on the way RSA is implemented, a failure
+ * in the computation can lead to disclosure of the private
+ * key if the wrong result is passed to attacker - e.g.,
+ * implementing RSA through CRT is vulnerable to the
+ * Bellcore glitch attack.
+ *
+ * As a remedy, the user can force double checking the
+ * result of the private key operation through the option
+ * MBEDTLS_RSA_FORCE_VERIFICATION. If verification is
+ * to be enabled only when RSA-CRT is used (as controlled
+ * by the configuration option MBEDTLS_RSA_NO_CRT), the
+ * option MBEDTLS_RSA_FORCE_CRT_VERIFICATION can be used.
+ *
*/
int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
int (*f_rng)(void *, unsigned char *, size_t),