-
Notifications
You must be signed in to change notification settings - Fork 15
Description
Description
As part of RSA private key import checks, the OTBN takes in a private key and returns validity check values which the main processor then uses to perform hardened comparisons to expected values.
Three of these hardened checks return the multi-limb value 1, which--from a FI perspective--undesirably means that many of the upper limbs of the returned check value are all zero.
Instead, a hardened value such as kHardenedBoolTrue should be returned. One approach (suggested by @jadephilipoom) is to incorporate a randomized full-width multiplicative mask into each of the computations, then return this initial mask and the masked result. Since the unmasked computation should come to 1, the mask and masked result will be identical exactly when the key check passes.