X-Git-Url: http://git.xonotic.org/?a=blobdiff_plain;f=d0_blind_id.c;h=f33084cb912d77fe467da0dd7c9e979ae0c9d3b1;hb=b94a48ee30742aa25c4b4d744ea34b34996c0610;hp=8852402cfe544e317bdd4c429b0ee3c192f4d8cc;hpb=933873052795f6abc14deead27f0f652a7e401e1;p=xonotic%2Fd0_blind_id.git

diff --git a/d0_blind_id.c b/d0_blind_id.c
index 8852402..f33084c 100644
--- a/d0_blind_id.c
+++ b/d0_blind_id.c
@@ -47,7 +47,7 @@
 #define SHA_DIGESTSIZE 32
 const char *sha(const unsigned char *in, size_t len)
 {
-	static char h[32];
+	static __thread char h[32];
 	d0_blind_id_util_sha256(h, (const char *) in, len);
 	return h;
 }
@@ -109,10 +109,20 @@ struct d0_blind_id_s
 #define USING(x) if(!(ctx->x)) return 0
 #define REPLACING(x)
 
-static d0_bignum_t *zero, *one, *four, *temp0, *temp1, *temp2, *temp3, *temp4;
+// safe to use
+static d0_bignum_t *zero, *one, *four;
+
+static d0_bignum_t *temp0, *temp1, *temp2, *temp3, *temp4;
+static void *tempmutex = NULL; // hold this mutex when using temp0 to temp4
+#define USINGTEMPS() int locked = 0
+#define LOCKTEMPS() do { if(!locked) d0_lockmutex(tempmutex); locked = 1; } while(0)
+#define UNLOCKTEMPS() do { if(locked) d0_unlockmutex(tempmutex); locked = 0; } while(0);
 
 D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_INITIALIZE(void)
 {
+	USINGTEMPS();
+	tempmutex = d0_createmutex();
+	LOCKTEMPS();
 	CHECK(d0_bignum_INITIALIZE());
 	CHECK_ASSIGN(zero, d0_bignum_int(zero, 0));
 	CHECK_ASSIGN(one, d0_bignum_int(one, 1));
@@ -122,13 +132,17 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_INITIALIZE(void)
 	CHECK_ASSIGN(temp2, d0_bignum_int(temp2, 0));
 	CHECK_ASSIGN(temp3, d0_bignum_int(temp3, 0));
 	CHECK_ASSIGN(temp4, d0_bignum_int(temp4, 0));
+	UNLOCKTEMPS();
 	return 1;
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
 void d0_blind_id_SHUTDOWN(void)
 {
+	USINGTEMPS();
+	LOCKTEMPS();
 	d0_bignum_free(zero);
 	d0_bignum_free(one);
 	d0_bignum_free(four);
@@ -138,10 +152,13 @@ void d0_blind_id_SHUTDOWN(void)
 	d0_bignum_free(temp3);
 	d0_bignum_free(temp4);
 	d0_bignum_SHUTDOWN();
+	UNLOCKTEMPS();
+	d0_destroymutex(tempmutex);
+	tempmutex = NULL;
 }
 
 // (G-1)/2
-d0_bignum_t *d0_dl_get_order(d0_bignum_t *o, const d0_bignum_t *G)
+static d0_bignum_t *d0_dl_get_order(d0_bignum_t *o, const d0_bignum_t *G)
 {
 	CHECK_ASSIGN(o, d0_bignum_sub(o, G, one));
 	CHECK(d0_bignum_shl(o, o, -1)); // order o = (G-1)/2
@@ -159,13 +176,15 @@ fail:
 	return NULL;
 }
 
-D0_BOOL d0_dl_generate_key(size_t size, d0_bignum_t *G)
+// temps must NOT be locked when calling this
+static D0_BOOL d0_dl_generate_key(size_t size, d0_bignum_t *G)
 {
-	// using: temp0
+	USINGTEMPS(); // using: temp0
 	if(size < 16)
 		size = 16;
 	for(;;)
 	{
+		LOCKTEMPS();
 		CHECK(d0_bignum_rand_bit_exact(temp0, size-1));
 		if(d0_bignum_isprime(temp0, 0) == 0)
 			continue;
@@ -174,16 +193,19 @@ D0_BOOL d0_dl_generate_key(size_t size, d0_bignum_t *G)
 			continue;
 		if(d0_bignum_isprime(temp0, 10) == 0) // finish the previous test
 			continue;
+		UNLOCKTEMPS();
 		break;
 	}
 	return 1;
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
-D0_BOOL d0_rsa_generate_key(size_t size, const d0_bignum_t *challenge, d0_bignum_t *d, d0_bignum_t *n)
+// temps must NOT be locked when calling this
+static D0_BOOL d0_rsa_generate_key(size_t size, d0_blind_id_t *ctx)
 {
-	// uses temp0 to temp4
+	USINGTEMPS(); // uses temp1 to temp4
 	int fail = 0;
 	int gcdfail = 0;
 	int pb = (size + 1)/2;
@@ -192,54 +214,76 @@ D0_BOOL d0_rsa_generate_key(size_t size, const d0_bignum_t *challenge, d0_bignum
 		pb = 8;
 	if(qb < 8)
 		qb = 8;
+
+	// we use ctx->rsa_d for the first result so that we can unlock temps later
         for (;;)
 	{
-		CHECK(d0_bignum_rand_bit_exact(temp0, pb));
-		if(d0_bignum_isprime(temp0, 10) == 0)
+		LOCKTEMPS();
+		CHECK(d0_bignum_rand_bit_exact(ctx->rsa_d, pb));
+		if(d0_bignum_isprime(ctx->rsa_d, 10) == 0)
+		{
+			UNLOCKTEMPS();
 			continue;
-		CHECK(d0_bignum_sub(temp2, temp0, one));
-		CHECK(d0_bignum_gcd(temp4, NULL, NULL, temp2, challenge));
+		}
+		CHECK(d0_bignum_sub(temp2, ctx->rsa_d, one));
+		CHECK(d0_bignum_gcd(temp4, NULL, NULL, temp2, ctx->rsa_e));
 		if(!d0_bignum_cmp(temp4, one))
 			break;
 		if(++gcdfail == 3)
-			return 0;
+			goto fail;
 		++gcdfail;
 	}
+	UNLOCKTEMPS();
+
 	gcdfail = 0;
         for (;;)
 	{
+		LOCKTEMPS();
 		CHECK(d0_bignum_rand_bit_exact(temp1, qb));
-		if(!d0_bignum_cmp(temp1, temp0))
+		if(!d0_bignum_cmp(temp1, ctx->rsa_d))
 		{
+			UNLOCKTEMPS();
 			if(++fail == 3)
-				return 0;
+				goto fail;
+			continue;
 		}
 		fail = 0;
 		if(d0_bignum_isprime(temp1, 10) == 0)
+		{
+			UNLOCKTEMPS();
 			continue;
+		}
 		CHECK(d0_bignum_sub(temp3, temp1, one));
-		CHECK(d0_bignum_gcd(temp4, NULL, NULL, temp3, challenge));
+		CHECK(d0_bignum_gcd(temp4, NULL, NULL, temp3, ctx->rsa_e));
 		if(!d0_bignum_cmp(temp4, one))
+		{
+			// we do NOT unlock, as we still need temp1 and temp3
 			break;
+		}
+		UNLOCKTEMPS();
 		if(++gcdfail == 3)
-			return 0;
+			goto fail;
 		++gcdfail;
 	}
 
-	// n = temp0*temp1
-	CHECK(d0_bignum_mul(n, temp0, temp1));
+	// ctx->rsa_n = ctx->rsa_d*temp1
+	CHECK(d0_bignum_mul(ctx->rsa_n, ctx->rsa_d, temp1));
 
-	// d = challenge^-1 mod (temp0-1)(temp1-1)
+	// ctx->rsa_d = ctx->rsa_e^-1 mod (ctx->rsa_d-1)(temp1-1)
+	CHECK(d0_bignum_sub(temp2, ctx->rsa_d, one)); // we can't reuse the value from above because temps were unlocked
 	CHECK(d0_bignum_mul(temp0, temp2, temp3));
-	CHECK(d0_bignum_mod_inv(d, challenge, temp0));
+	CHECK(d0_bignum_mod_inv(ctx->rsa_d, ctx->rsa_e, temp0));
+	UNLOCKTEMPS();
 	return 1;
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
-D0_BOOL d0_rsa_generate_key_fastreject(size_t size, d0_fastreject_function reject, d0_blind_id_t *ctx, void *pass)
+// temps must NOT be locked when calling this
+static D0_BOOL d0_rsa_generate_key_fastreject(size_t size, d0_fastreject_function reject, d0_blind_id_t *ctx, void *pass)
 {
-	// uses temp0 to temp4
+	USINGTEMPS(); // uses temp1 to temp4
 	int fail = 0;
 	int gcdfail = 0;
 	int pb = (size + 1)/2;
@@ -248,12 +292,18 @@ D0_BOOL d0_rsa_generate_key_fastreject(size_t size, d0_fastreject_function rejec
 		pb = 8;
 	if(qb < 8)
 		qb = 8;
+
+	// we use ctx->rsa_d for the first result so that we can unlock temps later
         for (;;)
 	{
-		CHECK(d0_bignum_rand_bit_exact(temp0, pb));
-		if(d0_bignum_isprime(temp0, 10) == 0)
+		LOCKTEMPS();
+		CHECK(d0_bignum_rand_bit_exact(ctx->rsa_d, pb));
+		if(d0_bignum_isprime(ctx->rsa_d, 10) == 0)
+		{
+			UNLOCKTEMPS();
 			continue;
-		CHECK(d0_bignum_sub(temp2, temp0, one));
+		}
+		CHECK(d0_bignum_sub(temp2, ctx->rsa_d, one));
 		CHECK(d0_bignum_gcd(temp4, NULL, NULL, temp2, ctx->rsa_e));
 		if(!d0_bignum_cmp(temp4, one))
 			break;
@@ -261,38 +311,56 @@ D0_BOOL d0_rsa_generate_key_fastreject(size_t size, d0_fastreject_function rejec
 			return 0;
 		++gcdfail;
 	}
+	UNLOCKTEMPS();
+
 	gcdfail = 0;
         for (;;)
 	{
+		LOCKTEMPS();
 		CHECK(d0_bignum_rand_bit_exact(temp1, qb));
-		if(!d0_bignum_cmp(temp1, temp0))
+		if(!d0_bignum_cmp(temp1, ctx->rsa_d))
 		{
+			UNLOCKTEMPS();
 			if(++fail == 3)
 				return 0;
+			continue;
 		}
 		fail = 0;
 
-		// n = temp0*temp1
-		CHECK(d0_bignum_mul(ctx->rsa_n, temp0, temp1));
+		// n = ctx->rsa_d*temp1
+		CHECK(d0_bignum_mul(ctx->rsa_n, ctx->rsa_d, temp1));
 		if(reject(ctx, pass))
+		{
+			UNLOCKTEMPS();
 			continue;
+		}
 
 		if(d0_bignum_isprime(temp1, 10) == 0)
+		{
+			UNLOCKTEMPS();
 			continue;
+		}
 		CHECK(d0_bignum_sub(temp3, temp1, one));
 		CHECK(d0_bignum_gcd(temp4, NULL, NULL, temp3, ctx->rsa_e));
 		if(!d0_bignum_cmp(temp4, one))
+		{
+			// we do NOT unlock, as we still need temp3
 			break;
+		}
+		UNLOCKTEMPS();
 		if(++gcdfail == 3)
 			return 0;
 		++gcdfail;
 	}
 
-	// ctx->rsa_d = ctx->rsa_e^-1 mod (temp0-1)(temp1-1)
-	CHECK(d0_bignum_mul(temp0, temp2, temp3));
+	// ctx->rsa_d = ctx->rsa_e^-1 mod (ctx->rsa_d-1)(temp1-1)
+	CHECK(d0_bignum_sub(temp2, ctx->rsa_d, one)); // we can't reuse the value from above because temps were unlocked
+	CHECK(d0_bignum_mul(ctx->rsa_d, temp2, temp3));
 	CHECK(d0_bignum_mod_inv(ctx->rsa_d, ctx->rsa_e, temp0));
+	UNLOCKTEMPS();
 	return 1;
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
@@ -316,7 +384,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_longhash_destructive(unsigned char *convbuf, si
 
 D0_WARN_UNUSED_RESULT D0_BOOL d0_longhash_bignum(const d0_bignum_t *in, unsigned char *outbuf, size_t outbuflen)
 {
-	static unsigned char convbuf[1024];
+	static __thread unsigned char convbuf[1024];
 	size_t sz;
 
 	CHECK(d0_bignum_export_unsigned(in, convbuf, sizeof(convbuf)) >= 0);
@@ -381,7 +449,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_generate_private_key_fastreject(d0_bli
 	if(reject)
 		CHECK(d0_rsa_generate_key_fastreject(k+1, reject, ctx, pass)); // must fit G for sure
 	else
-		CHECK(d0_rsa_generate_key(k+1, ctx->rsa_e, ctx->rsa_d, ctx->rsa_n)); // must fit G for sure
+		CHECK(d0_rsa_generate_key(k+1, ctx)); // must fit G for sure
 	return 1;
 fail:
 	return 0;
@@ -463,7 +531,7 @@ fail:
 D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_fingerprint64_public_key(const d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
 	d0_iobuf_t *out = NULL;
-	static unsigned char convbuf[2048];
+	static __thread unsigned char convbuf[2048];
 	d0_iobuf_t *conv = NULL;
 	size_t sz, n;
 
@@ -536,27 +604,30 @@ fail:
 
 D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_generate_private_id_start(d0_blind_id_t *ctx)
 {
-	// temps: temp0 = order
+	USINGTEMPS(); // temps: temp0 = order
 	USING(schnorr_G);
 	REPLACING(schnorr_s); REPLACING(schnorr_g_to_s);
 
+	LOCKTEMPS();
 	CHECK(d0_dl_get_order(temp0, ctx->schnorr_G));
 	CHECK_ASSIGN(ctx->schnorr_s, d0_bignum_rand_range(ctx->schnorr_s, zero, temp0));
 	CHECK_ASSIGN(ctx->schnorr_g_to_s, d0_bignum_mod_pow(ctx->schnorr_g_to_s, four, ctx->schnorr_s, ctx->schnorr_G));
 	CHECK_ASSIGN(ctx->schnorr_H_g_to_s_signature, d0_bignum_zero(ctx->schnorr_H_g_to_s_signature));
+	UNLOCKTEMPS();
 	return 1;
 
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
 D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_generate_private_id_request(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
 	d0_iobuf_t *out = NULL;
-	static unsigned char shabuf[2048];
+	static __thread unsigned char shabuf[2048];
 	size_t sz;
 
-	// temps: temp0 rsa_blind_signature_camouflage^challenge, temp1 (4^s)*rsa_blind_signature_camouflage^challenge
+	USINGTEMPS(); // temps: temp0 rsa_blind_signature_camouflage^challenge, temp1 (4^s)*rsa_blind_signature_camouflage^challenge
 	USING(rsa_n); USING(rsa_e); USING(schnorr_g_to_s);
 	REPLACING(rsa_blind_signature_camouflage);
 
@@ -566,6 +637,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_generate_private_id_request(d0_blind_i
 	CHECK(d0_bignum_mod_pow(temp0, ctx->rsa_blind_signature_camouflage, ctx->rsa_e, ctx->rsa_n));
 
 	// we will actually sign HA(4^s) to prevent a malleability attack!
+	LOCKTEMPS();
 	CHECK(d0_bignum_mov(temp2, ctx->schnorr_g_to_s));
 	sz = (d0_bignum_size(ctx->rsa_n) + 7) / 8; // this is too long, so we have to take the value % rsa_n when "decrypting"
 	if(sz > sizeof(shabuf))
@@ -576,9 +648,11 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_generate_private_id_request(d0_blind_i
 	// hash complete
 	CHECK(d0_bignum_mod_mul(temp1, temp2, temp0, ctx->rsa_n));
 	CHECK(d0_iobuf_write_bignum(out, temp1));
+	UNLOCKTEMPS();
 	return d0_iobuf_close(out, outbuflen);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(out, outbuflen);
 	return 0;
 }
@@ -588,20 +662,23 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_answer_private_id_request(const d0_bli
 	d0_iobuf_t *in = NULL;
 	d0_iobuf_t *out = NULL;
 
-	// temps: temp0 input, temp1 temp0^d
+	USINGTEMPS(); // temps: temp0 input, temp1 temp0^d
 	USING(rsa_d); USING(rsa_n);
 
 	in = d0_iobuf_open_read(inbuf, inbuflen);
 	out = d0_iobuf_open_write(outbuf, *outbuflen);
 
+	LOCKTEMPS();
 	CHECK(d0_iobuf_read_bignum(in, temp0));
 	CHECK(d0_bignum_mod_pow(temp1, temp0, ctx->rsa_d, ctx->rsa_n));
 	CHECK(d0_iobuf_write_bignum(out, temp1));
 
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	return d0_iobuf_close(out, outbuflen);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	d0_iobuf_close(out, outbuflen);
 	return 0;
@@ -611,19 +688,23 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_finish_private_id_request(d0_blind_id_
 {
 	d0_iobuf_t *in = NULL;
 
-	// temps: temp0 input, temp1 rsa_blind_signature_camouflage^-1
+	USINGTEMPS(); // temps: temp0 input, temp1 rsa_blind_signature_camouflage^-1
 	USING(rsa_blind_signature_camouflage); USING(rsa_n);
 	REPLACING(schnorr_H_g_to_s_signature);
 
 	in = d0_iobuf_open_read(inbuf, inbuflen);
 
+	LOCKTEMPS();
+
 	CHECK(d0_iobuf_read_bignum(in, temp0));
 	CHECK(d0_bignum_mod_inv(temp1, ctx->rsa_blind_signature_camouflage, ctx->rsa_n));
 	CHECK_ASSIGN(ctx->schnorr_H_g_to_s_signature, d0_bignum_mod_mul(ctx->schnorr_H_g_to_s_signature, temp0, temp1, ctx->rsa_n));
 
+	UNLOCKTEMPS();
 	return d0_iobuf_close(in, NULL);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	return 0;
 }
@@ -742,12 +823,12 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_start(d0_
 //   1. get random r, send HASH(4^r)
 {
 	d0_iobuf_t *out = NULL;
-	static unsigned char convbuf[1024];
+	static __thread unsigned char convbuf[1024];
 	d0_iobuf_t *conv = NULL;
 	size_t sz = 0;
 	D0_BOOL failed = 0;
 
-	// temps: temp0 order, temp0 4^r
+	USINGTEMPS(); // temps: temp0 order, temp0 4^r
 	if(is_first)
 	{
 		USING(schnorr_g_to_s); USING(schnorr_H_g_to_s_signature);
@@ -768,6 +849,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_start(d0_
 
 	// start schnorr ID scheme
 	// generate random number r; x = g^r; send hash of x, remember r, forget x
+	LOCKTEMPS();
 	CHECK(d0_dl_get_order(temp0, ctx->schnorr_G));
 #ifdef RNG_XKCD
 	CHECK_ASSIGN(ctx->r, d0_bignum_int(ctx->r, 4)); // decided by fair dice roll
@@ -794,6 +876,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_start(d0_
 	CHECK(d0_iobuf_write_bignum(conv, ctx->g_to_t));
 	CHECK(d0_iobuf_write_packet(conv, msg, msglen));
 	CHECK(d0_iobuf_write_bignum(conv, temp0));
+	UNLOCKTEMPS();
 	CHECK(d0_iobuf_write_bignum(conv, ctx->g_to_t));
 	d0_iobuf_close(conv, &sz);
 	conv = NULL;
@@ -803,6 +886,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_start(d0_
 	return d0_iobuf_close(out, outbuflen);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(out, outbuflen);
 	return 0;
 }
@@ -815,10 +899,10 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_challenge
 {
 	d0_iobuf_t *in = NULL;
 	d0_iobuf_t *out = NULL;
-	static unsigned char shabuf[2048];
+	static __thread unsigned char shabuf[2048];
 	size_t sz;
 
-	// temps: temp0 order, temp0 signature check
+	USINGTEMPS(); // temps: temp0 order, temp0 signature check
 	if(is_first)
 	{
 		REPLACING(schnorr_g_to_s); REPLACING(schnorr_H_g_to_s_signature);
@@ -854,6 +938,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_challenge
 		CHECK(d0_bignum_cmp(ctx->schnorr_H_g_to_s_signature, ctx->rsa_n) < 0);
 
 		// check signature of key (t = k^d, so, t^challenge = k)
+		LOCKTEMPS();
 		CHECK(d0_bignum_mod_pow(temp0, ctx->schnorr_H_g_to_s_signature, ctx->rsa_e, ctx->rsa_n));
 
 		// we will actually sign SHA(4^s) to prevent a malleability attack!
@@ -888,6 +973,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_challenge
 	CHECK(d0_iobuf_write_bignum(out, ctx->challenge));
 
 	// Diffie Hellmann send
+	LOCKTEMPS();
 	CHECK(d0_dl_get_order(temp0, ctx->schnorr_G));
 #ifdef RNG_XKCD
 	CHECK_ASSIGN(ctx->t, d0_bignum_int(ctx->t, 4)); // decided by fair dice roll
@@ -896,6 +982,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_challenge
 #endif
 	CHECK(d0_bignum_mod_pow(temp0, four, ctx->t, ctx->schnorr_G));
 	CHECK(d0_iobuf_write_bignum(out, temp0));
+	UNLOCKTEMPS();
 
 	if(status)
 		*status = !!d0_bignum_cmp(ctx->schnorr_H_g_to_s_signature, zero);
@@ -904,6 +991,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_challenge
 	return d0_iobuf_close(out, outbuflen);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	d0_iobuf_close(out, outbuflen);
 	return 0;
@@ -916,13 +1004,14 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_response(
 	d0_iobuf_t *in = NULL;
 	d0_iobuf_t *out = NULL;
 
-	// temps: 0 order, 1 prod, 2 y, 3 challenge
+	USINGTEMPS(); // temps: 0 order, 1 prod, 2 y, 3 challenge
 	REPLACING(other_g_to_t); REPLACING(t);
 	USING(schnorr_G); USING(schnorr_s); USING(r); USING(g_to_t);
 
 	in = d0_iobuf_open_read(inbuf, inbuflen);
 	out = d0_iobuf_open_write(outbuf, *outbuflen);
 
+	LOCKTEMPS();
 	CHECK(d0_iobuf_read_bignum(in, temp3));
 	CHECK(d0_bignum_cmp(temp3, zero) >= 0);
 	CHECK(d0_bignum_size(temp3) <= SCHNORR_BITS);
@@ -937,6 +1026,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_response(
 	CHECK(d0_bignum_mod_sub(temp2, ctx->r, temp1, temp0));
 #endif
 	CHECK(d0_iobuf_write_bignum(out, temp2));
+	UNLOCKTEMPS();
 
 	// Diffie Hellmann recv
 	CHECK_ASSIGN(ctx->other_g_to_t, d0_iobuf_read_bignum(in, ctx->other_g_to_t));
@@ -949,6 +1039,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_response(
 	return d0_iobuf_close(out, outbuflen);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	d0_iobuf_close(out, outbuflen);
 	return 0;
@@ -960,16 +1051,18 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_verify(d0
 //      (check using H(g^r) which we know)
 {
 	d0_iobuf_t *in = NULL;
-	static unsigned char convbuf[1024];
+	static __thread unsigned char convbuf[1024];
 	d0_iobuf_t *conv = NULL;
 	size_t sz;
 
-	// temps: 0 y 1 order
+	USINGTEMPS(); // temps: 0 y 1 order
 	USING(challenge); USING(schnorr_G);
 	REPLACING(other_g_to_t);
 
 	in = d0_iobuf_open_read(inbuf, inbuflen);
 
+	LOCKTEMPS();
+
 	CHECK(d0_dl_get_order(temp1, ctx->schnorr_G));
 	CHECK(d0_iobuf_read_bignum(in, temp0));
 	CHECK(d0_bignum_cmp(temp0, zero) >= 0);
@@ -998,6 +1091,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_verify(d0
 	CHECK(d0_iobuf_write_bignum(conv, ctx->other_g_to_t));
 	CHECK(d0_iobuf_write_packet(conv, ctx->msg, ctx->msglen));
 	CHECK(d0_iobuf_write_bignum(conv, temp3));
+	UNLOCKTEMPS();
 	CHECK(d0_iobuf_write_bignum(conv, ctx->other_g_to_t));
 	d0_iobuf_close(conv, &sz);
 	conv = NULL;
@@ -1020,6 +1114,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_verify(d0
 	return 1;
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	return 0;
 }
@@ -1027,25 +1122,31 @@ fail:
 D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_authenticate_with_private_id_generate_missing_signature(d0_blind_id_t *ctx)
 {
 	size_t sz;
-	static unsigned char shabuf[2048];
+	static __thread unsigned char shabuf[2048];
 
+	USINGTEMPS(); // temps: 2 hash
 	REPLACING(schnorr_H_g_to_s_signature);
 	USING(schnorr_g_to_s); USING(rsa_d); USING(rsa_n);
 
+	LOCKTEMPS();
+
 	// we will actually sign SHA(4^s) to prevent a malleability attack!
-	CHECK(d0_bignum_mov(temp2, ctx->schnorr_g_to_s));
 	sz = (d0_bignum_size(ctx->rsa_n) + 7) / 8; // this is too long, so we have to take the value % rsa_n when "decrypting"
 	if(sz > sizeof(shabuf))
 		sz = sizeof(shabuf);
-	CHECK(d0_longhash_bignum(temp2, shabuf, sz));
+	CHECK(d0_longhash_bignum(ctx->schnorr_g_to_s, shabuf, sz));
+	LOCKTEMPS();
 	CHECK(d0_bignum_import_unsigned(temp2, shabuf, sz));
 
 	// + 7 / 8 is too large, so let's mod it
 	CHECK(d0_bignum_divmod(NULL, temp1, temp2, ctx->rsa_n));
 	CHECK(d0_bignum_mod_pow(ctx->schnorr_H_g_to_s_signature, temp1, ctx->rsa_d, ctx->rsa_n));
+
+	UNLOCKTEMPS();
 	return 1;
 
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
@@ -1053,10 +1154,11 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_sign_internal(d0_
 {
 	d0_iobuf_t *out = NULL;
 	unsigned char *convbuf = NULL;
-	static unsigned char shabuf[2048];
+	static __thread unsigned char shabuf[2048];
 	d0_iobuf_t *conv = NULL;
 	size_t sz = 0;
 
+	USINGTEMPS(); // temps: 0 order 1 4^r 2 hash
 	if(is_first)
 	{
 		USING(schnorr_g_to_s); USING(schnorr_H_g_to_s_signature);
@@ -1078,6 +1180,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_sign_internal(d0_
 
 	// start schnorr SIGNATURE scheme
 	// generate random number r; x = g^r; send hash of H(m||r), remember r, forget x
+	LOCKTEMPS();
 	CHECK(d0_dl_get_order(temp0, ctx->schnorr_G));
 	CHECK_ASSIGN(ctx->r, d0_bignum_rand_range(ctx->r, zero, temp0));
 	CHECK(d0_bignum_mod_pow(temp1, four, ctx->r, ctx->schnorr_G));
@@ -1102,6 +1205,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_sign_internal(d0_
 	CHECK(d0_bignum_mod_sub(temp2, ctx->r, temp1, temp0));
 #endif
 	CHECK(d0_iobuf_write_bignum(out, temp2));
+	UNLOCKTEMPS();
 
 	// write the message itself
 	if(with_msg)
@@ -1110,6 +1214,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_sign_internal(d0_
 	return d0_iobuf_close(out, outbuflen);
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(out, outbuflen);
 	return 0;
 }
@@ -1127,9 +1232,10 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_verify_internal(d
 	d0_iobuf_t *in = NULL;
 	d0_iobuf_t *conv = NULL;
 	unsigned char *convbuf = NULL;
-	static unsigned char shabuf[2048];
+	static __thread unsigned char shabuf[2048];
 	size_t sz;
 
+	USINGTEMPS(); // temps: 0 sig^e 2 g^s 3 g^-s 4 order
 	if(is_first)
 	{
 		REPLACING(schnorr_g_to_s); REPLACING(schnorr_H_g_to_s_signature);
@@ -1163,14 +1269,14 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_verify_internal(d
 		CHECK(d0_bignum_cmp(ctx->schnorr_H_g_to_s_signature, ctx->rsa_n) < 0);
 
 		// check signature of key (t = k^d, so, t^challenge = k)
+		LOCKTEMPS();
 		CHECK(d0_bignum_mod_pow(temp0, ctx->schnorr_H_g_to_s_signature, ctx->rsa_e, ctx->rsa_n));
 
 		// we will actually sign SHA(4^s) to prevent a malleability attack!
-		CHECK(d0_bignum_mov(temp2, ctx->schnorr_g_to_s));
 		sz = (d0_bignum_size(ctx->rsa_n) + 7) / 8; // this is too long, so we have to take the value % rsa_n when "decrypting"
 		if(sz > sizeof(shabuf))
 			sz = sizeof(shabuf);
-		CHECK(d0_longhash_bignum(temp2, shabuf, sz));
+		CHECK(d0_longhash_bignum(ctx->schnorr_g_to_s, shabuf, sz));
 		CHECK(d0_bignum_import_unsigned(temp2, shabuf, sz));
 
 		// + 7 / 8 is too large, so let's mod it
@@ -1216,6 +1322,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_verify_internal(d
 
 	// verify signature
 	CHECK(!d0_bignum_cmp(temp0, temp1));
+	UNLOCKTEMPS();
 
 	if(status)
 		*status = !!d0_bignum_cmp(ctx->schnorr_H_g_to_s_signature, zero);
@@ -1224,6 +1331,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_verify_internal(d
 	return 1;
 
 fail:
+	UNLOCKTEMPS();
 	d0_iobuf_close(in, NULL);
 	return 0;
 }
@@ -1239,7 +1347,7 @@ D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_sign_with_private_id_verify_detached(d
 D0_WARN_UNUSED_RESULT D0_BOOL d0_blind_id_fingerprint64_public_id(const d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
 	d0_iobuf_t *out = NULL;
-	static unsigned char convbuf[1024];
+	static __thread unsigned char convbuf[1024];
 	d0_iobuf_t *conv = NULL;
 	size_t sz, n;
 
@@ -1273,13 +1381,19 @@ fail:
 
 D0_BOOL d0_blind_id_sessionkey_public_id(const d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
+	D0_BOOL ret;
+
+	USINGTEMPS(); // temps: temp0 result
 	USING(t); USING(other_g_to_t); USING(schnorr_G);
 
-	// temps: temp0 result
+	LOCKTEMPS();
 	CHECK(d0_bignum_mod_pow(temp0, ctx->other_g_to_t, ctx->t, ctx->schnorr_G));
-	return d0_longhash_bignum(temp0, (unsigned char *) outbuf, *outbuflen);
+	ret = d0_longhash_bignum(temp0, (unsigned char *) outbuf, *outbuflen);
+	UNLOCKTEMPS();
+	return ret;
 
 fail:
+	UNLOCKTEMPS();
 	return 0;
 }
 
@@ -1303,3 +1417,12 @@ void d0_blind_id_util_sha256(char *out, const char *in, size_t n)
 	SHA256_Update(&context, (const unsigned char *) in, n);
 	return SHA256_Final((unsigned char *) out, &context);
 }
+
+void d0_blind_id_setmallocfuncs(d0_malloc_t *m, d0_free_t *f)
+{
+	d0_setmallocfuncs(m, f);
+}
+void d0_blind_id_setmutexfuncs(d0_createmutex_t *c, d0_destroymutex_t *d, d0_lockmutex_t *l, d0_unlockmutex_t *u)
+{
+	d0_setmutexfuncs(c, d, l, u);
+}