1
$\begingroup$

In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values:

$T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$

$T_0 = T_M - \omega ExpTMult$

where $T_M$ is the timing for $y^x\ mod\ m$, $TMult$ the timing for the multiplication, $\omega$ the Hamming weight of the exponent and $ExpTMult$ the expected timing value for a multiplication. We calculated these values for every sample. Then, if $\Sigma_{sample} T_1\ <\ \Sigma_{sample} T_0$ the LSB is likely 1. Similar for the following bits.

Question: What happens after a incorrect guess?

The linked paper says (Sec. 3):

after an incorrect exponent bit guess, no more meaningful correlations are observed.

So, it is $\Sigma T_1 \approx \Sigma T_0 $ for the following bits?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.