Plan to address RSA attacks of eprint.iacr.org/2020/055?

https://eprint.iacr.org/2020/055.pdf describes side channel attacks affecting mbedtls ECDSA signing and RSA key loading. It appears the ECDSA signing was already resolved in 247c4d3c8876d but as best I can determine the RSA side channel has not yet been resolved since `mbedtls_rsa_deduce_crt` (https://github.com/ARMmbed/mbed-crypto/blob/development/library/rsa_internal.c#L480) invokes `mbedtls_mpi_inv_mod` (https://github.com/ARMmbed/mbed-crypto/blob/development/library/bignum.c#L2345) which is implemented using an extended binary GCD which leaks information due to conditional branching and which additional invokes binary GCD which is also leaky (https://github.com/ARMmbed/mbed-crypto/blob/development/library/bignum.c#L2252), the second being the attack implemented in 2020/055 though they note that the BEEA implementation can also be used as a source of information.

I wanted to know if you have plans to address these issues and/or would be willing to accept patches addressing them.

For computing Q^-1 mod P following the papers suggested remediation of using a side-channel secured mod-exp and computing Q^(P-2) mod P seems good to me, albeit with some probable runtime overhead.

The paper https://gcd.cr.yp.to/safegcd-20190413.pdf proposes various constant-time algorithms for GCD and extended GCD. In particular the plain GCD algorithm (Figure 1.2 in the paper) is quite easy to implement.

Another option for inversion is the algorithm given in the appendix of https://hal.inria.fr/hal-01506572/document (Algorithm 5) which works for any odd modulus and is quite easily implemented in const time.

Start with library/rsa_internal.c at mbedtls_rsa_deduce_crt and library/bignum.c at mbedtls_mpi_inv_mod and its binary-GCD implementation, then review the linked attack papers. Done requires an agreed, side-channel-resistant resolution for RSA key loading, but the repository states that development has moved to Mbed TLS and this repository receives no further updates.

Written by the indexing model from the issue text.