)]}' { "commit": "5f4f26f59c364b603c2d10ddab71ce34913284b5", "tree": "6462a85878971d1929dfe26155a5c9e504942041", "parents": [ "21113ed83b2cd0a55e3db7a448353cbb4a1991e9" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sun Dec 07 14:53:36 2025 -0500" }, "committer": { "name": "Boringssl LUCI CQ", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Dec 08 11:14:35 2025 -0800" }, "message": "Retire RSA blinding support\n\nThe idea to do RSA blinding dates back to one of the first papers on\ntiming attacks in RSA in 1996. Our blinding code dates to around that\ntime (OpenSSL git history ends at 1998).\nhttps://paulkocher.com/doc/TimingAttacks.pdf\n\nIn the last 30 years, we\u0027ve gained a much better understanding of side\nchannel mitigations. In particular, blinding was added when OpenSSL\u0027s\nRSA implementation was very far from constant-time. BoringSSL\u0027s RSA\nimplementation has now been constant-time for some time now, which\nprotects against cache and timing side channels more thoroughly than\nblinding does. (Blinding of the base doesn\u0027t mask the exponent.)\n\nWith a constant-time implementation, RSA blinding is no longer\nload-bearing. It is also surprisingly expensive. The mod-inverse step\ncosts a sizeable fraction of the signing operation itself, to the point\nthat even the original paper suggested caching the mod-inverse operation\nand squaring to rerandomize. This mitigation has some issues:\n\n- The blinding values are no longer independent secrets, so the\n mathematical grounds for the technique are shakier.\n\n- Single-use RSA keys still pay for the full inversion.\n\n- Long-lived RSA keys pay for cross-thread synchronization and cacheline\n contention.\n\nGiven it\u0027s redundant with a constant-time RSA signing implementation,\njust remove it. Go\u0027s crypto/rsa package similarly dropped blinding when\nthey became constant-time.\n\nA comparison on a Intel(R) Xeon(R) Gold 6154 CPU @ 3.00GHz: signing with\nsingle-use RSA keys decreases significantly. Multiple-use RSA keys also\nsee a significant benefit because we remove a source of thread\ncontention.\n\nBenchmark Time CPU Time Old Time New CPU Old CPU New\n------------------------------------------------------------------------------------------------------------------------------------------\nBM_SpeedRSASign/2048/threads:1 -0.0252 -0.0253 543443 529729 543420 529672\nBM_SpeedRSASign/2048/threads:72 -0.1449 -0.1598 1141309 975876 1131652 950843\nBM_SpeedRSAImportKeyAndSign/2048/threads:1 -0.3323 -0.3323 945512 631272 945414 631261\nBM_SpeedRSAImportKeyAndSign/2048/threads:72 -0.2901 -0.3001 1567751 1112956 1515580 1060742\nBM_SpeedRSASign/3072/threads:1 -0.0497 -0.0494 1731748 1645764 1731232 1645727\nBM_SpeedRSASign/3072/threads:72 -0.1760 -0.1927 3590240 2958464 3540956 2858770\nBM_SpeedRSAImportKeyAndSign/3072/threads:1 -0.2063 -0.2063 2391296 1897868 2390855 1897622\nBM_SpeedRSAImportKeyAndSign/3072/threads:72 -0.2224 -0.2465 4213323 3276466 4092405 3083547\nBM_SpeedRSASign/4096/threads:1 -0.0150 -0.0151 3715336 3659534 3714992 3658934\nBM_SpeedRSASign/4096/threads:72 -0.1192 -0.0854 8024291 7067945 7647429 6994248\nBM_SpeedRSAImportKeyAndSign/4096/threads:1 -0.1910 -0.1909 4905741 3968685 4904703 3968311\nBM_SpeedRSAImportKeyAndSign/4096/threads:72 -0.1554 -0.1193 9182005 7755037 8483022 7471388\n\n(Since this is the first output of the new benchmark comparison script,\nthe time is measured in nanoseconds, and the -0.3323 means a 33.23%\nreduction in time per iteration.)\n\nChange-Id: I4738fb8b0539408b86faafb6ae8751aa2265f831\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/85368\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "0f3eb70051c0db3dc69357c32d8e36b7f92a8740", "old_mode": 33188, "old_path": "SANDBOXING.md", "new_id": "58604636dea97ce160bd22dcf4a6cb6bea840835", "new_mode": 33188, "new_path": "SANDBOXING.md" }, { "type": "modify", "old_id": "9a829d7d0d8506763effa3fcb4dc08cae88819db", "old_mode": 33188, "old_path": "build.json", "new_id": "aad40fab907a3e83a70a22429281d71cf05ef926", "new_mode": 33188, "new_path": "build.json" }, { "type": "modify", "old_id": "d80d012242f78b7f58dec1eed2d240343e694518", "old_mode": 33188, "old_path": "crypto/evp/test/rsa_tests.txt", "new_id": "8dff8cb7b8b08055481657161dde8f12bbdc3c51", "new_mode": 33188, "new_path": "crypto/evp/test/rsa_tests.txt" }, { "type": "modify", "old_id": "daea544c5cff94ed1fffeed16b9379626e5334c6", "old_mode": 33188, "old_path": "crypto/fipsmodule/bcm.cc", "new_id": "7cb4bdcb6b810b0f7007cccaab402ace741b2edf", "new_mode": 33188, "new_path": "crypto/fipsmodule/bcm.cc" }, { "type": "delete", "old_id": "75e98e1c7a9d5c1adc59b714f219ab5efd3f0391", "old_mode": 33188, "old_path": "crypto/fipsmodule/rsa/blinding.cc.inc", "new_id": "0000000000000000000000000000000000000000", "new_mode": 0, "new_path": "/dev/null" }, { "type": "modify", "old_id": "12fa09c279abe17cbb95e1445a094ad5c69d9d29", "old_mode": 33188, "old_path": "crypto/fipsmodule/rsa/internal.h", "new_id": "99577e7e6b6ede60eb664f77eae918c0751704e2", "new_mode": 33188, "new_path": "crypto/fipsmodule/rsa/internal.h" }, { "type": "modify", "old_id": "cd302b18930c2de74011511992bcbad06b50bb17", "old_mode": 33188, "old_path": "crypto/fipsmodule/rsa/rsa_impl.cc.inc", "new_id": "2f0eeb083690fbf662585b25e91b644bc2a3a592", "new_mode": 33188, "new_path": "crypto/fipsmodule/rsa/rsa_impl.cc.inc" }, { "type": "modify", "old_id": "300c892ec48d0e95f99d6b4672c91c2c800cd23b", "old_mode": 33188, "old_path": "crypto/fipsmodule/self_check/self_check.cc.inc", "new_id": "c2c58daa39ee1bdf0df80d933d6b975b969135bd", "new_mode": 33188, "new_path": "crypto/fipsmodule/self_check/self_check.cc.inc" }, { "type": "modify", "old_id": "18a0badc839d5fa919eb5f7306bcf0b0d9486255", "old_mode": 33188, "old_path": "crypto/rsa/rsa_test.cc", "new_id": "d9172c896093c6e70bb8976d35d57f3bcf5469ea", "new_mode": 33188, "new_path": "crypto/rsa/rsa_test.cc" }, { "type": "modify", "old_id": "e8fbdc8d95033933e146980e94993dbd4c1ddbfe", "old_mode": 33188, "old_path": "gen/sources.bzl", "new_id": "26d2b7e691ec4c66683116a51f5b76c907f37e0d", "new_mode": 33188, "new_path": "gen/sources.bzl" }, { "type": "modify", "old_id": "f147448f7b7fd4e64abda287ab15db0f77c10546", "old_mode": 33188, "old_path": "gen/sources.cmake", "new_id": "420ee80e44517abf3a00352049c87aa4c8720d43", "new_mode": 33188, "new_path": "gen/sources.cmake" }, { "type": "modify", "old_id": "fcfb34dd09b32fb164e53313d91e770860891214", "old_mode": 33188, "old_path": "gen/sources.gni", "new_id": "e8b4f54494a6cd2ac90779eae5231748a034ef2f", "new_mode": 33188, "new_path": "gen/sources.gni" }, { "type": "modify", "old_id": "c0850640d1cd50d7f8addf8b417e6ddc7395315a", "old_mode": 33188, "old_path": "gen/sources.json", "new_id": "f4bb576e4806f3ba344acfeaed10764f98cc559d", "new_mode": 33188, "new_path": "gen/sources.json" }, { "type": "modify", "old_id": "58594c820055e194ddc572e204cd4f6768727169", "old_mode": 33188, "old_path": "gen/sources.mk", "new_id": "1650efff0cdda1953049d80e026a06361eeb9bf5", "new_mode": 33188, "new_path": "gen/sources.mk" }, { "type": "modify", "old_id": "8fbb1ae099c23cb0e3edec24c90db724f860703e", "old_mode": 33188, "old_path": "include/openssl/rsa.h", "new_id": "7c20dab5b74e99db701c155dde364a9caa072737", "new_mode": 33188, "new_path": "include/openssl/rsa.h" }, { "type": "modify", "old_id": "f5be99b817563c8860a486fc6f43a104a729f2c7", "old_mode": 33188, "old_path": "util/all_tests.json", "new_id": "24ed89032fe78dbe4675b06c3d54c9f45daf1d4f", "new_mode": 33188, "new_path": "util/all_tests.json" } ] }