What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$?

I'm working from this paper: Volker Müller, Experimental Results for Timing Attacks on Elliptic Curve Cryptosystems (pdf), in Proceedings of the National Seminar on "Penerapan dan Pemanfaatan Mobile Application dalam Dunia Bisnis, Industri dan Pendidikan", Atma Jaya University, Sep. 2003.

There, it is guessed 10 bits of $k$ from $Q=k\times P_i$, but there is no explanation of how many random points $P_i$ he tests.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.