tree 0821c6cea1058d3dd633dbb7bfb6f60533ae2775
parent 395d8c1222939ca90bf928759f46952930868ca0
author Janos Follath <janos.follath@arm.com> 1571303931 +0100
committer Janos Follath <janos.follath@arm.com> 1571990494 +0100

ECDSA: Fix side channel vulnerability

The blinding applied to the scalar before modular inversion is
inadequate. Bignum is not constant time/constant trace, side channel
attacks can retrieve the blinded value, factor it (it is smaller than
RSA keys and not guaranteed to have only large prime factors). Then the
key can be recovered by brute force.

Reducing the blinded value makes factoring useless because the adversary
can only recover pk*t+z*N instead of pk*t.