Set up the RSA's _method_mod_n before the initial blinding

As observed by Bernd Edlinger, the main part of the RSA timing leak that was
recently made public is that the initial blinding isn't done with Montgomery
exponentiation but rather with plain exponentiation.

Pull up the initialization of the cached Montgomery context to ensure we use
Montgomery exponentiation. Do this for private_{de,en}crypt(). Interestingly,
the latter was fixed in OpenSSL a while ago by Andy Polyakov as part of the
"smooth CRT-RSA" addition.

If this code was anything but completely insane this would never have been
an issue in the first place. But it's libcrypto...

ok jsing

0 files changed, 0 insertions, 0 deletions