Masking Private Key Operations

TL;DR

This guide shows you how to use blinding techniques to hide your private key during cryptographic operations like signing or decryption, improving security. We’ll cover the concept and a simple example using OpenSSL.

What is Blinding?

Blinding is a technique used in cryptography to obscure the relationship between a message and its signature (or plaintext). It works by transforming the message before it’s processed with your private key. This makes it harder for an attacker who observes the operations to deduce information about your key, even if they can see everything else.

Why use Blinding?

• Protection against side-channel attacks: Attackers might try to learn your key by analysing power consumption or timing variations during cryptographic operations. Blinding makes these analyses more difficult.
• Security in delegated signing: If you need someone else to sign a message on your behalf, blinding prevents them from learning your private key.

How does it work?

The basic idea is this:

1. Generate a random ‘blinding factor’ (r). This should be unpredictable and kept secret.
2. Transform the message: Multiply your message (M) by the blinding factor (r): M’ = M * r
3. Perform the operation with the transformed message: Use your private key to sign or decrypt M’.
4. Unblind the result: Divide the output of the operation by the blinding factor (r) to get the final, correct result.

Because the attacker only sees operations on M’, and doesn’t know r, it’s much harder for them to figure out your private key.

Example using OpenSSL

This example demonstrates blinding during RSA signing. It uses a simplified approach; real-world implementations often involve more sophisticated techniques.

Step 1: Generate an RSA Key Pair

openssl genrsa -out private.pem 2048

openssl rsa -in private.pem -pubout -out public.pem

Step 2: Create a Message to Sign

Let’s say our message is the string “This is my important document”. We need to convert it into a numerical representation for RSA.

Step 3: Generate a Random Blinding Factor

Choose a random number that’s relatively prime to the modulus of your RSA key. A simple way (for demonstration) is using OpenSSL’s rand function:

openssl rand -base64 16

This will output a 16-byte random string, which we’ll use as our blinding factor (r). Convert this base64 string to a decimal number for calculations.

Step 4: Blind the Message

We’ll need to convert both the message and the blinding factor into numbers. For simplicity, let’s assume we have these values:

• Message (M): 123456789
• Blinding Factor (r): 987654321

Calculate the blinded message (M’):

M' = M * r = 123456789 * 987654321 = 121932631112635609

Step 5: Sign the Blinded Message

Use OpenSSL to sign the blinded message with your private key:

openssl dgst -sha256 -sign private.pem -out signature.bin <(echo -n "121932631112635609")

Step 6: Unblind the Signature

After signing, you have a signature for M’. To get the actual signature for M, divide the signature by the blinding factor. This requires modular arithmetic (division in the field of RSA). OpenSSL doesn’t directly provide an unblinding function; this step often needs custom scripting or libraries.

Important: The division must be performed modulo N (the modulus of your RSA key) to get the correct result. This is a crucial step and requires careful implementation.

Important Considerations

• Randomness: Your blinding factor r must be truly random and kept secret.
• Modular Arithmetic: Correctly implementing modular arithmetic for unblinding is essential.
• Key Size: Blinding doesn’t make your key magically stronger; it protects the operations, not the key itself. Use appropriate key sizes.
• Library Support: Many cryptographic libraries provide built-in blinding functions. Using these is generally safer and easier than implementing it yourself.