commit 2d8624dae26734f55d1bd9aaad1abefc084b2e57
author Janos Follath <janos.follath@arm.com> Tue Nov 21 09:46:43 2023 +0000
committer Janos Follath <janos.follath@arm.com> Tue Nov 21 09:46:43 2023 +0000
tree a68b4f90c742fcaeb679cec764aa87220eda5e4d
parent 10f8366499e7a45b67d55c88160ecda1d652e2f9

Extend blinding to RSA result check

Signed-off-by: Janos Follath <janos.follath@arm.com>

library/rsa.c

diff --git a/library/rsa.c b/library/rsa.c
index c559f11..9dc0ec5 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -1125,8 +1125,6 @@
         goto cleanup;
     }
 
-    MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&I, &T));
-
     /*
      * Blinding
      * T = T * Vi mod N
@@ -1135,6 +1133,8 @@
     MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&T, &T, &ctx->Vi));
     MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(&T, &T, &ctx->N));
 
+    MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&I, &T));
+
     /*
      * Exponent blinding
      */
@@ -1203,12 +1203,6 @@
     MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&T, &TQ, &TP));
 #endif /* MBEDTLS_RSA_NO_CRT */
 
-    /*
-     * Unblind
-     * T = T * Vf mod N
-     */
-    MBEDTLS_MPI_CHK(rsa_unblind(&T, &ctx->Vf, &ctx->N));
-
     /* Verify the result to prevent glitching attacks. */
     MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&C, &T, &ctx->E,
                                         &ctx->N, &ctx->RN));
@@ -1217,6 +1211,12 @@
         goto cleanup;
     }
 
+    /*
+     * Unblind
+     * T = T * Vf mod N
+     */
+    MBEDTLS_MPI_CHK(rsa_unblind(&T, &ctx->Vf, &ctx->N));
+
     olen = ctx->len;
     MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&T, output, olen));