From 26f1f6061deabc15400835d278763cadb39aad71 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Fri, 9 Mar 2018 10:47:30 +0000 Subject: [PATCH] Improve documentation on the use of blinding in RSA --- include/mbedtls/rsa.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/mbedtls/rsa.h b/include/mbedtls/rsa.h index fb2f77f94..5548f3c12 100644 --- a/include/mbedtls/rsa.h +++ b/include/mbedtls/rsa.h @@ -518,6 +518,18 @@ int mbedtls_rsa_public( mbedtls_rsa_context *ctx, * * \note The input and output buffers must be large * enough. For example, 128 Bytes if RSA-1024 is used. + * + * \note Blinding is used if and only if a PRNG is provided. + * + * \note If blinding is used, both the base of exponentation + * and the exponent are blinded, providing protection + * against some side-channel attacks. + * + * \warning It is deprecated and a security risk to not provide + * a PRNG here and thereby prevent the use of blinding. + * Future versions of the library may enforce the presence + * of a PRNG. + * */ int mbedtls_rsa_private( mbedtls_rsa_context *ctx, int (*f_rng)(void *, unsigned char *, size_t),