ElGamal decryption vulnerable to side channel attacks

[Legrandin]

The ElGamal decryption is vulnerable to side channel attacks as the one recently described here (for libgcrypt):

http://blog.cryptographyengineering.com/2012/10/attack-of-week-cross-vm-timing-attacks.html

The problem is that ElGamal.decrypt() does:

ax=pow(M[0], self.x, self.p)

where M[0] is controlled by the attacker and self.x is the private key.
A tentative patch available here:

https://github.com/dlitz/pycrypto/pull/27

It adds randomized message blinding to all decryptions, similarly to RSA.
I am not sure it is the best way, but it's a start.

[Darsey Litzenberger (dlitz)]

Committed to master branch: https://github.com/dlitz/pycrypto/commit/ce92486a1d8a4abbff2d40b2be737ca09dd98c6a