diff --git a/ChangeLog b/ChangeLog
index b5075c9ae2092c274643ce7f37779473d64639ab..a9d0b1e79cfb2aa12fe183d6e8adc22347d71deb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
2018-11-25 Niels Möller <nisse@lysator.liu.se>
+ * rsa-sign-tr.c (_rsa_sec_compute_root_tr): Renamed, from...
+ (rsa_sec_compute_root_tr): ... old name. Updated callers.
+ * rsa.h (rsa_sec_compute_root_tr): Deleted declaration, moved to ...
+ * rsa-internal.h (_rsa_sec_compute_root_tr): ... new location.
+
* testsuite/testutils.c (mpz_urandomb) [NETTLE_USE_MINI_GMP]: Fix
masking of most significant bits.
@@ -17,6 +22,9 @@
* testsuite/pkcs1-sec-decrypt-test.c (pkcs1_decrypt_for_test): Fix
valgrind marking of return value.
+ Merged below changes from Simo Sorce, to make RSA private key
+ operations side-channel silent.
+
2018-11-08 Simo Sorce <simo@redhat.com>
* rsa-sign.c (rsa_compute_root) [!NETTLE_USE_MINI_GMP]: Use
diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
index 8fbe847e4ea0d25db21b6d3bddcb4d513226d98d..5dfb91b1a2618ed0a79a24a960061a65d31229e0 100644
--- a/rsa-decrypt-tr.c
+++ b/rsa-decrypt-tr.c
@@ -57,9 +57,9 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
TMP_GMP_ALLOC (m, key_limb_size);
TMP_GMP_ALLOC (em, key->size);
- res = rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
- mpz_limbs_read(gibberish),
- mpz_size(gibberish));
+ res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
+ mpz_limbs_read(gibberish),
+ mpz_size(gibberish));
mpn_get_base256 (em, key->size, m, key_limb_size);
diff --git a/rsa-internal.h b/rsa-internal.h
index a1e182535a934f45a0405ebc3619c22409e8df8a..4e63f75106764046dcf44515d5fcd1ec5eb640d1 100644
--- a/rsa-internal.h
+++ b/rsa-internal.h
@@ -38,6 +38,7 @@
#define _rsa_sec_compute_root_itch _nettle_rsa_sec_compute_root_itch
#define _rsa_sec_compute_root _nettle_rsa_sec_compute_root
+#define _rsa_sec_compute_root_tr _nettle_rsa_sec_compute_root_tr
#define _pkcs1_sec_decrypt _nettle_pkcs1_sec_decrypt
#define _pkcs1_sec_decrypt_variable _nettle_pkcs1_sec_decrypt_variable
@@ -49,6 +50,14 @@ _rsa_sec_compute_root(const struct rsa_private_key *key,
mp_limb_t *rp, const mp_limb_t *mp,
mp_limb_t *scratch);
+/* Safe side-channel silent variant, using RSA blinding, and checking the
+ * result after CRT. */
+int
+_rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
+ const struct rsa_private_key *key,
+ void *random_ctx, nettle_random_func *random,
+ mp_limb_t *x, const mp_limb_t *m, size_t mn);
+
/* additional resistance to memory access side-channel attacks.
* Note: message buffer is returned unchanged on error */
int
diff --git a/rsa-sec-decrypt.c b/rsa-sec-decrypt.c
index 35dbe162b221cd1644736a50b81f9fd3d32bf32e..e6a4b26712fbd88746c649b567c47d3b9bedd949 100644
--- a/rsa-sec-decrypt.c
+++ b/rsa-sec-decrypt.c
@@ -57,9 +57,9 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
TMP_GMP_ALLOC (m, mpz_size(pub->n));
TMP_GMP_ALLOC (em, key->size);
- res = rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
- mpz_limbs_read(gibberish),
- mpz_size(gibberish));
+ res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
+ mpz_limbs_read(gibberish),
+ mpz_size(gibberish));
mpn_get_base256 (em, key->size, m, mpz_size(pub->n));
diff --git a/rsa-sign-tr.c b/rsa-sign-tr.c
index 524abb5a8fa06e404b29fe99b151220b08f8ced1..be320b23669e5fa81ea1792dc60e0809c483a7df 100644
--- a/rsa-sign-tr.c
+++ b/rsa-sign-tr.c
@@ -293,10 +293,10 @@ cnd_mpn_zero (int cnd, volatile mp_ptr rp, mp_size_t n)
* This version is side-channel silent even in case of error,
* the destination buffer is always overwritten */
int
-rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
- const struct rsa_private_key *key,
- void *random_ctx, nettle_random_func *random,
- mp_limb_t *x, const mp_limb_t *m, size_t mn)
+_rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
+ const struct rsa_private_key *key,
+ void *random_ctx, nettle_random_func *random,
+ mp_limb_t *x, const mp_limb_t *m, size_t mn)
{
TMP_GMP_DECL (c, mp_limb_t);
TMP_GMP_DECL (ri, mp_limb_t);
@@ -359,8 +359,8 @@ rsa_compute_root_tr(const struct rsa_public_key *pub,
mp_size_t l_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
TMP_GMP_ALLOC (l, l_size);
- res = rsa_sec_compute_root_tr (pub, key, random_ctx, random, l,
- mpz_limbs_read(m), mpz_size(m));
+ res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, l,
+ mpz_limbs_read(m), mpz_size(m));
if (res) {
mp_limb_t *xp = mpz_limbs_write (x, l_size);
mpn_copyi (xp, l, l_size);
diff --git a/rsa.h b/rsa.h
index 108bc7da613ef4edb32ac3d2f8c430e49fd2f0e6..0aac6a26bce3c5a5eb4a57a43b99915099dbaf53 100644
--- a/rsa.h
+++ b/rsa.h
@@ -91,7 +91,6 @@ extern "C" {
#define rsa_sec_decrypt nettle_rsa_sec_decrypt
#define rsa_compute_root nettle_rsa_compute_root
#define rsa_compute_root_tr nettle_rsa_compute_root_tr
-#define rsa_sec_compute_root_tr _nettle_rsa_sec_compute_root_tr
#define rsa_generate_keypair nettle_rsa_generate_keypair
#define rsa_keypair_to_sexp nettle_rsa_keypair_to_sexp
#define rsa_keypair_from_sexp_alist nettle_rsa_keypair_from_sexp_alist
@@ -447,14 +446,6 @@ rsa_compute_root_tr(const struct rsa_public_key *pub,
void *random_ctx, nettle_random_func *random,
mpz_t x, const mpz_t m);
-/* Safe side-channel silent variant, using RSA blinding, and checking the
- * result after CRT. */
-int
-rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
- const struct rsa_private_key *key,
- void *random_ctx, nettle_random_func *random,
- mp_limb_t *x, const mp_limb_t *m, size_t mn);
-
/* Key generation */
/* Note that the key structs must be initialized first. */