- ret = RSA_private_decrypt(inlen, inbuf, outbuf, rsa, RSA_PKCS1_PADDING);
- rsa_free(rsa);
- return (ret > 0)? ret : -E_DECRYPT;
-}
-
-/**
- * decrypt the challenge number sent by para_server
- *
- * \param key_file full path of the rsa key
- * \param challenge_nr result is stored here
- * \param inbuf the input buffer
- * \param rsa_inlen the length of \a inbuf
- *
- * \return positive on success, negative on errors
- *
- * \sa para_decrypt_buffer()
- */
-int para_decrypt_challenge(char *key_file, long unsigned *challenge_nr,
- unsigned char *inbuf, unsigned rsa_inlen)
-{
- unsigned char *rsa_out = OPENSSL_malloc(rsa_inlen + 1);
- int ret = para_decrypt_buffer(key_file, rsa_out, inbuf, rsa_inlen);
-
- if (ret >= 0) {
- rsa_out[ret] = '\0';
- ret = sscanf((char *)rsa_out, "%lu", challenge_nr) == 1?
- 1 : -E_CHALLENGE;
- }
- OPENSSL_free(rsa_out);
+ /*
+ * RSA is vulnerable to timing attacks. Generate a random blinding
+ * factor to protect against this kind of attack.
+ */
+ ret = -E_BLINDING;
+ if (RSA_blinding_on(priv->rsa, NULL) == 0)
+ goto out;
+ ret = RSA_private_decrypt(inlen, inbuf, outbuf, priv->rsa,
+ RSA_PKCS1_OAEP_PADDING);
+ RSA_blinding_off(priv->rsa);
+ if (ret <= 0)
+ ret = -E_DECRYPT;
+out:
+ free_asymmetric_key(priv);