Blind the default RSA decryption paths

Cargo.toml

@@ -51,7 +51,7 @@ rstest = "0.26.1"
 name = "key"
 
 [features]
-default = ["std", "encoding"]
+default = ["std", "encoding", "getrandom"]
 std = ["pkcs1?/std", "pkcs8?/std"]
 
 encoding = ["dep:pkcs1", "dep:pkcs8", "dep:spki"]

src/key.rs

@@ -652,9 +652,24 @@ impl RsaPrivateKey {
     }
 
     /// Decrypt the given message.
+    ///
+    /// With the `getrandom` feature (enabled by default), uses the operating system RNG for
+    /// RSA blinding. Without this feature, decryption is unblinded; use
+    /// [`Self::decrypt_blinded`] to supply an RNG explicitly.
     #[allow(clippy::missing_errors_doc, reason = "TODO")]
     pub fn decrypt<P: PaddingScheme>(&self, padding: P, ciphertext: &[u8]) -> Result<Vec<u8>> {
-        padding.decrypt(Option::<&mut DummyRng>::None, self, ciphertext)
+        #[cfg(feature = "getrandom")]
+        {
+            padding.decrypt(
+                Some(&mut crypto_common::getrandom::SysRng),
+                self,
+                ciphertext,
+            )
+        }
+        #[cfg(not(feature = "getrandom"))]
+        {
+            padding.decrypt(Option::<&mut DummyRng>::None, self, ciphertext)
+        }
     }
 
     /// Decrypt the given message.

src/oaep/decrypting_key.rs

@@ -1,6 +1,7 @@
 use super::decrypt_digest;
+#[cfg(not(feature = "getrandom"))]
+use crate::dummy_rng::DummyRng;
 use crate::{
-    dummy_rng::DummyRng,
     traits::{Decryptor, RandomizedDecryptor},
     Result, RsaPrivateKey,
 };
@@ -14,6 +15,10 @@ use zeroize::ZeroizeOnDrop;
 
 /// Decryption key for PKCS#1 v1.5 decryption as described in [RFC8017 § 7.1].
 ///
+/// [`Decryptor::decrypt`] uses the operating system RNG for blinding when the `getrandom`
+/// feature is enabled (the default). Otherwise, use [`RandomizedDecryptor::decrypt_with_rng`]
+/// to supply an RNG for blinding.
+///
 /// [RFC8017 § 7.1]: https://datatracker.ietf.org/doc/html/rfc8017#section-7.1
 #[derive(Debug, Clone)]
 #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
@@ -61,7 +66,19 @@ where
     MGD: Digest + FixedOutputReset,
 {
     fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>> {
-        decrypt_digest::<DummyRng, D, MGD>(None, &self.inner, ciphertext, self.label.clone())
+        #[cfg(feature = "getrandom")]
+        {
+            decrypt_digest::<_, D, MGD>(
+                Some(&mut crypto_common::getrandom::SysRng),
+                &self.inner,
+                ciphertext,
+                self.label.clone(),
+            )
+        }
+        #[cfg(not(feature = "getrandom"))]
+        {
+            decrypt_digest::<DummyRng, D, MGD>(None, &self.inner, ciphertext, self.label.clone())
+        }
     }
 }
 

src/pkcs1v15/decrypting_key.rs

@@ -1,6 +1,7 @@
 use super::{decrypt, EncryptingKey};
+#[cfg(not(feature = "getrandom"))]
+use crate::dummy_rng::DummyRng;
 use crate::{
-    dummy_rng::DummyRng,
     traits::{Decryptor, EncryptingKeypair, RandomizedDecryptor},
     Result, RsaPrivateKey,
 };
@@ -12,6 +13,10 @@ use zeroize::ZeroizeOnDrop;
 
 /// Decryption key for PKCS#1 v1.5 decryption as described in [RFC8017 § 7.2].
 ///
+/// [`Decryptor::decrypt`] uses the operating system RNG for blinding when the `getrandom`
+/// feature is enabled (the default). Otherwise, use [`RandomizedDecryptor::decrypt_with_rng`]
+/// to supply an RNG for blinding.
+///
 /// [RFC8017 § 7.2]: https://datatracker.ietf.org/doc/html/rfc8017#section-7.2
 #[derive(Debug, Clone, PartialEq)]
 #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
@@ -29,7 +34,18 @@ impl DecryptingKey {
 
 impl Decryptor for DecryptingKey {
     fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>> {
-        decrypt::<DummyRng>(None, &self.inner, ciphertext)
+        #[cfg(feature = "getrandom")]
+        {
+            decrypt(
+                Some(&mut crypto_common::getrandom::SysRng),
+                &self.inner,
+                ciphertext,
+            )
+        }
+        #[cfg(not(feature = "getrandom"))]
+        {
+            decrypt::<DummyRng>(None, &self.inner, ciphertext)
+        }
     }
 }