tree 272428777fceed24f75b061762e83bcc337be570
parent 069fb0e09a01b1a45004093f29923d0554f87c12
author Janos Follath <janos.follath@arm.com> 1571303931 +0100
committer Janos Follath <janos.follath@arm.com> 1571991081 +0100

ECDSA: Fix side channel vulnerability

The blinding applied to the scalar before modular inversion is
inadequate. Bignum is not constant time/constant trace, side channel
attacks can retrieve the blinded value, factor it (it is smaller than
RSA keys and not guaranteed to have only large prime factors). Then the
key can be recovered by brute force.

Reducing the blinded value makes factoring useless because the adversary
can only recover pk*t+z*N instead of pk*t.