# Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003).

In this paper on page 4, Brumley specifies the following steps :

Step 1. Calculate guess, $g$.

Step 2. Calculate $U_g = g\cdot R^{-1}\bmod N$

Step 3. Send $U_g$ to Server for decryption and note the time before and after.

My queries:

1. How should $g$ look like for a 3 bit combination of "101" when we are searching for peaks ?

2. The CLIENT_KEY_EXCHANGE message, which will be $g$ here, should be unencrypted. Am I right ?