Protocol for Sharing Blinding Factor with RSA

Question

What is the protocol for choosing blinding factor when RSA is applied with key blinding?

(Related question: How would you find the Blinding factor R in RSA blind signature algorithm?)

1. Since blinding factor R should be randomly chosen, who has control over how R is chosen - the client (public key user), or the server (private key user)? If the client has control over the choice, the client can defult to the same value of R every time & thus defeat the purpose of choosing a random R.
2. Given that R must be a shared value for every encrypt/decrypt operation (sort of an IV like parameter for symmetric ciphers), which protocols supported the transmission of a blinding factor?

Answer 1

First of all, you need to understand what's the point of key blinding in the first place.

First of all, you have a server (who has a private key, and who is willing to decrypt messages), and you have a client (who has a value who he wants decrypted, but is unwilling to tell the server what that value is). The client might not want to tell the server what the value is to preserve anonymity (e.g. Chaum's ecoin idea, which uses a similar idea with signatures), or perhaps because he is afraid that the server might leak that info (e.g. through a side-channel).

So, what the client does is pick a random value $R$ (and keeps it to himself); the encrypted message $C$, and computes $R^e \cdot C \bmod N$ (where $e, N$ are from the server's public key); we then asks the server to do an RSA decryption of that.

Then, the server computes $(R^e \cdot C)^d \bmod N = R \cdot C^d \bmod N $ ($d$ is server's private key), and sends that back to the client.

Then, the client computes $R^{-1} \bmod N$, and then $R^{-1} \cdot (R \cdot C^d) = C^d$, which is the decrypted (padded) message $P$.

Because we allow $R$ to be any value (relatively prime to $N$), then $R^e \cdot C$ can also be any value, and so the server gets no information about what he's decrypting.

With that background in mind, let us go through your questions:

1. Who has control over how $R$ is chosen?

As you can see from the above example, the client does.

If it's the client, what's preventing him from picking the same value of $R$ every time.

Absolutely nothing. There's also nothing preventing him from publishing the value $P$ in the Times, if he were so minded. $R$ is there to protect the client's data; if he doesn't do things correctly, it's his own data that suffers.

2. Given that R must be a shared value for every encrypt/decrypt operation

Actually, if you go through the above, $R$ is used only during the decrypt operation (or the signature operation); the original encryptor (the guy who created $C = P^e$ in the first place) need not know it (or even if RSA blinding was being used). The client needs to use the same $R$ to compute both $R^e \cdot C$ and $R^{-1} \cdot (R \cdot C^d)$, however that's both in the decryption process, and the client never needs to give $R$ to anyone else (in fact, that would rather mess up what $R$ is trying to do)