# Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$?

I'm working from this paper: Volker Müller, Experimental Results for Timing Attacks on Elliptic Curve Cryptosystems (pdf), in Proceedings of the National Seminar on "Penerapan dan Pemanfaatan Mobile Application dalam Dunia Bisnis, Industri dan Pendidikan", Atma Jaya University, Sep. 2003.

There, it is guessed 10 bits of $k$ from $Q=k\times P_i$, but there is no explanation of how many random points $P_i$ he tests.