[gnutls-dev] bug in _gnutls_pkcs1_rsa_encrypt

[Werner Koch]

On Mon, 16 Aug 2004 17:46:23 -0700, Robey Pointer said:

> and almost always only the 3rd byte is used.  This seems like a waste
> of the random pool, and my hunch is that the fetch of 3 random bytes
> was meant to go OUTSIDE the loop.

FWIW, here is how GnuPG does it:

    p = gcry_random_bytes_secure (i, GCRY_STRONG_RANDOM);
    /* replace zero bytes by new values */
    for(;;) {
	int j, k;
	byte *pp;

	/* count the zero bytes */
	for(j=k=0; j < i; j++ )
	    if( !p[j] )
		k++;
	if( !k )
	    break; /* okay: no zero bytes */
	k += k/128; /* better get some more */
	pp = gcry_random_bytes_secure( k, GCRY_STRONG_RANDOM);
	for(j=0; j < i && k ; j++ )
	    if( !p[j] )
		p[j] = pp[--k];
	xfree (pp);
    }

Libgcrypt also provides pkcs#1 handling.  The code above has not yet
been converted to this new Libgcrypt feature.


Salam-Shalom,

   Werner