# Tag Info

For Q1, you could leak the key efficiently by using something like a fountain code (which are conceptually similar to secret sharing schemes). For example, you could map the key to the coefficients of a polynomial $p$ over a finite field $F$ (of suitable size), evaluate it at a random point $a \in F$ (or $a \in S$ for some subset $S \subset F$), and leak ...
As you say, if the measurements are accurate then the device can leak $log_2(n)$ bits of information on each invocation. If it lacks internal storage then it can't track which parts of the key it has already leaked. What it can do is leak a random set of bits, but the recipient has to know which bits they are. I see two approaches. If the timing channel ...