Cloudflare's circl has a partially blind RSA signer. Its Blind method takes an io.Reader. The blinding factor used that reader. The salt did not. It read from crypto/rand directly.
That breaks the contract. Two calls with the same deterministic reader should give the same blinded message. They did not, because half the randomness came from somewhere else. The sibling code in brsa.go did it right and used the supplied reader throughout.
The fix is one line in blindsign/blindrsa/partiallyblindrsa/pbrsa.go:
_, err := io.ReadFull(random, salt)
It used to read from rand.Reader. Now it reads from random, the reader the caller passed in.
The test pins it down. TestBlindUsesSuppliedReader calls Blind twice with fresh deterministic readers that emit the same byte sequence. Both blinded messages must be identical. It fails before the fix and passes after. Callers passing crypto/rand see no behavior change.
Merged as cloudflare/circl#711: https://github.com/cloudflare/circl/pull/711
Top comments (0)