At this stage, they can either guess the remaining eight bits by brute force or continue their analytic approach, extracting the key in either case. If the program fails, there will be no faulty output to analyze. DES keys have odd parity, he pointed out, and a proper implementation will reject a key if any of its bytes has even parity. Rather than circumvent this hurdle, he put it to work, postulating a fault model in which the attacker can reset individual register bits to 1 as desired. Watching Nearly a year before the Bellcore fault-based attack, Paul Kocher had observed that attackers can measure the amount of time used to complete cryptographic operations. . . .
Timing channels can, and often do, leak key material.
Kocher showed, for example, that it is possible to attack the Chinese remainder theorem implementation of RSA by feeding it several messages slightly larger or slightly smaller than a suspected value of one of the two prime factors, say p , of the public key N . He takes advantage of the natural variation in the time required for bit-wise modular multiplication, depending on whether the key bit is 0 or 1. Underlying Kocher s analysis are simple probability models. The approach can be used to crack other implementations of RSA and other public-key schemes as well. In the end, mathematics cannot claim to have broken the codes it created, which in most cases remain secure and useful.