Remote Timing Attacks are Practical
2003 · paper · Computer science
Presents a timing attack on OpenSSL that extracts a server's private key by measuring response times. The authors report success across a campus network, between processes on one machine, and between virtual machines, and conclude that servers must defend against such attacks.
Checked: PDF from crypto.stanford.edu, fetched 4 Oct 2026. Page numbers are those of that PDF.
3 findings
Substance The blinding description gives the unblinding step as "x^e/r mod N". With x = r^e g mod N, decryption uses the private exponent, so the step should be x^d/r mod N.
- p. 12 Section 6 Defenses, first paragraph
by division by r, i.e. xe/r mod N
- p. 11 Section 6 Defenses
x = reg mod N before decryption
- p. 12 Section 6, first paragraph
i.e. xe/r mod N
Judge's note: Page 11 defines x = r^e g mod N, with e the RSA encryption exponent. Page 12 says "x is then decrypted as normal, followed by division by r, i.e. x^e/r mod N", and the image shows a superscript e. My own working: x^d = (r^e g)^d = r^{ed} g^d = r g^d mod N, so x^d/r = g^d, which is the decryption. By contrast, x^e/r = r^{e^2-1} g^e, which is not the plaintext. The formula is wrong as printed, and the prose ("decrypted as normal") shows the intended exponent is d.
Second check: another model agreed
Report a problem with this finding
Reference or label The author list of Reference [16] reads "Rao, Josyula, Rohatgi, and Pankaj", which splits two authors' surnames and given names into what look like four authors.
- p. 13 Reference [16]
Rao, Josyula, Rohatgi, and Pankaj
- p. 13 Reference [16]
Rao, Josyula, Rohatgi, and Pankaj.
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: the authors of 'Empowering side-channel attacks' (ePrint 2001/037) are Josyula R. Rao and Pankaj Rohatgi. The page 13 crop shows the entry exactly as quoted. The pairing of surname and given name in the printed entry is itself consistent with a BibTeX author-field formatting slip.
Second check: another model agreed
Report a problem with this finding
Wording The bound is printed as "2^511 (i.e. 2^{log2(N/2)−1})", but log2(N/2)−1 = log2 N − 2 = 1022 for 1024-bit N. The intended form is 2^{(log2 N)/2 − 1}.
- p. 4 Section 3, paragraph starting 'Initially our guess'
2511 (i.e. 2log2(N/2)−1)
Judge's note: The page 4 image shows the parentheses around N/2 in the exponent: log2(N/2)−1 = 1024−1−1 = 1022, not 511. The companion expression 2^{log2 N/2} for 2^512 is meant as (log2 N)/2. The numerical value 2^511 is printed correctly; only the explanatory expression is wrong as printed.
Second check: another model agreed
Report a problem with this finding
17 minor (typos and the like; most checked by the judge only)
Wording The Introduction says "Our results show that when using OpenSSL the network server VM can extract the RSA private key from the secure VM" and the Conclusion says the attack "is effective between ... two Virtual Machines on the same computer", but none of the Section 5 experiments involves VMs.
- p. 1 Introduction, Virtual Machines paragraph
Our results show that when using OpenSSL the network server VM can extract the RSA private key
- p. 12 Section 7 Conclusion
two Vir- tual Machines on the same computer
- p. 1 Introduction, 'Virtual Machines' paragraph
Our results show that when using OpenSSL the network server VM can extract the RSA private key from the se- cure VM
- p. 12 Section 7 Conclusion
the timing attack is effective be- tween two processes on the same machine and two Vir- tual Machines on the same computer
Only the authors can say what is right here.
Judge's note: The six listed experiments (page 6) and Sections 5.2–5.6 cover interprocess, local network and SSL application attacks. Searching for VM/Virtual finds it only in the Introduction (p1) and the Conclusion (p12). No VM experiment, table or figure is reported, so the claim appears to be extrapolated from the interprocess result. The authors should say whether a VM test was run.
Second check: another model agreed
Report a problem with this finding
Wording The Introduction says "using about a million queries we can remotely extract a 1024-bit RSA private key ... about two hours", while Section 5.2 gives "1433600 total queries" for the default two-hour attack and Section 5.4 says "about 1.4 million".
- p. 2 Introduction, paragraph on Sections
using about a million queries
- p. 7 Section 5.2
resulting in 1433600 total queries
- p. 9 Section 5.4
we again made about 1.4 million decryp-
- p. 2 Introduction, outline paragraph
We show that using about a million queries we can remotely extract a 1024-bit RSA private key
Judge's note: Page 2 and page 7 images checked. 2ns*log2N/4 with n=400, s=7 and log2N=1024 gives 1,433,600, which matches the printed figure. 'About a million' is loose rounding of the same configuration that the paper elsewhere calls 1.4 million.
Second check: another model agreed
Report a problem with this finding
Wording The sample-size definition says repeated samples of g+i are combined to "compute the mean decryption time", but Section 5.2 says "use the median time value as the effective decryption time".
- p. 6 Section 5.2, definition of Sample size
compute the mean decryption time
- p. 7 Section 5.2, first paragraph
use the median time value as the effective decryption time
Only the authors can say what is right here.
Judge's note: Page 6 (definition) and page 7 (first paragraph, with Figure 2(a) described as 'median values') both describe aggregating repeated samples of the same value, and they name different statistics. The paper does not distinguish the two stages.
Second check: another model agreed
Report a problem with this finding
Wording The constant-time Karatsuba defence is defined for a generic factor p_i ("c mod p_i * 2^m ... m = log2 p_i − log2(c mod p_i)"), but the correction step reads "the result is divided by 2^{md} mod q".
- p. 12 Section 6, second defence paragraph
the result is divided by 2md mod q
- p. 12 Section 6, second defence
After decryption, the result is divided by 2md mod q
Only the authors can say what is right here.
Judge's note: The page 12 crop shows the switch from p_i to q within a single construction. My working: decrypting c·2^m modulo p_i gives c^d·2^{md} mod p_i, so the correction factor should be reduced mod p_i. The symbol q matches the earlier sections, where q is the attacked factor, so q may be meant as one instance of p_i. As printed, though, the notation is inconsistent, and only the authors can say which form they intend.
Second check: another model agreed
Report a problem with this finding
Typo Number agreement: "Since both domain are hosted on the same machine" should read "both domains are".
- p. 1 Introduction, Interprocess paragraph
Since both domain are
- p. 1 Introduction, 'Interprocess' paragraph
Since both domain are hosted on the same machine
Judge's note: Page 1 image (Interprocess paragraph) shows "Since both domain are".
Second check: none (judge only)
Report a problem with this finding
Typo Figure 1 y-axis label reads "# of extra reductions in Montgery's algorithm"; it should be "Montgomery's".
- p. 3 Figure 1, y-axis label
# of extra reductions in Montgery’s algorithm
Judge's note: The misspelling is in the figure graphic itself on page 3.
Second check: none (judge only)
Report a problem with this finding
Typo "Step 3 We measure" lacks the " - " separator used in "Step 2 -" and "Step 4 -".
- p. 4 Section 3, Step 3
Step 3 We measure
Judge's note: The page 4 image confirms that the dash is missing after Step 3.
Second check: none (judge only)
Report a problem with this finding
Typo Duplicated word: "for each value of of g and ghi".
- p. 5 Section 4, paragraph 'In our attack'
for each value of of g and ghi
- p. 5
The client repeats this process for each value of of g and ghi
- p. 5
s this process for each value of of g and ghi needed to
Judge's note: The page 5 image shows "of of" within a single line.
Second check: code check
Report a problem with this finding
Typo The neighbourhood "g, g+1, g+2, ..., g+n" (sum from i=0 to n) has n+1 values, yet the neighbourhood size is "denoted by n" and "The total number of queries needed to compute Tg is then s ∗ n".
- p. 5 Section 3.1, definition of Tg
g, g +1, g +2, ..., g +n
- p. 6 Section 5.2
The total number of queries needed to compute Tg is then s ∗ n.
Judge's note: Page 5 shows Tg summed from i=0 to n, and page 6 defines the neighbourhood size as n with s*n queries. This is an off-by-one in the notation. It is numerically negligible, and the totals consistently use n.
Second check: none (judge only)
Report a problem with this finding
Typo Duplicated article: "Other architectures have a similar a counter".
- p. 6 Section 5.1, end of rdtsc paragraph
Other architectures have a similar a
- p. 6 Section 5.1
Other architectures have a similar a counter
Judge's note: The page 6 image shows "have a similar a" at the end of the line, followed by "counter".
Second check: none (judge only)
Report a problem with this finding
Typo "is surprising small" should be "is surprisingly small".
- p. 7 Section 5.2, first paragraph
is surprising small
- p. 7
is surprising small, requiring only 5 sam-
Judge's note: Confirmed on the page 7 image.
Second check: none (judge only)
Report a problem with this finding
Typo Program names are inconsistent: "the zero-one gap changes sign between the “normal” and “extra-inst” programs" (the program is defined as “regular”), and the Table 1 caption writes "“extra-instr” program" instead of “extra-inst”.
- p. 8 Section 5.4, last paragraph
gap changes sign between the “normal” and “extra-inst”
- p. 8 Section 5.4, last sentence
gap changes sign between the “normal” and “extra-inst” programs
- p. 8 Section 5.4
between the “normal” and “extra-inst” programs
- p. 9 Table 1 caption
“extra- instr” program
Judge's note: Page 8 defines the programs as “regular” and “extra-inst”, and Table 1 rows use those names. The text on page 8 says “normal”, and the caption on page 9 says “extra-instr”.
Second check: none (judge only)
Report a problem with this finding
Typo Table 1 caption calls the program "extra-instr" ("in the “extra-instr” program"), but the table rows and the text use "extra-inst".
- p. 9 Table 1 caption
in the “extra-instr” program
- p. 9 Table 1 caption
“extra-instr” program
Judge's note: Page 9 image: the table rows read “extra-inst”, the caption's first line reads “extra-inst”, and later in the same caption it reads “extra-instr” program. The text below also uses “extra-inst”. This is a cosmetic naming inconsistency.
Second check: none (judge only)
Report a problem with this finding
Typo The Figure 6(b) legend entry reads "Interprocess bit of (bit=0)". By parallel with the other entries it should read "Interprocess (bit=0)".
- p. 10 Figure 6 legend
Interprocess bit of (bit=0)
Judge's note: The crop of the figure on page 10 shows the legend entries "Internetwork (bit=0)", "Internetwork (bit=1)", "Interprocess bit of (bit=0)" and "Interprocess (bit=1)". The stray "bit of" is in the published figure, so this is not an extraction artefact.
Second check: none (judge only)
Report a problem with this finding
Typo In the Figure 7(a) legend, "Apache+mod_SSL" is typeset as "Apache+mod" followed by a subscript "S" and then "SL", because the underscore was treated as a subscript command.
- p. 11 Figure 7(a) legend
Apache+modSSL
Judge's note: The page 11 crop shows the subscript S in the Figure 7(a) legend. Figure 7(b) correctly shows "Apache+mod_SSL". This is a cosmetic typesetting slip.
Second check: none (judge only)
Report a problem with this finding
Typo Subject–verb disagreement: "The immediate drawbacks to this solution is that ...".
- p. 12 Section 6, final paragraph
The immedi- ate drawbacks to this solution is
Judge's note: The page 12 crop confirms the plural "drawbacks" with the singular "is". The sentence goes on to list two drawbacks, so "are" is the intended verb.
Second check: none (judge only)
Report a problem with this finding
Typo References [21] and [22] spell the co-author's name "Franois Koeune", while Reference [4] spells it "Francois Koeune".
- p. 13 Reference [21]
Werner Schindler, Franois Koeune
- p. 13 References [21] and [22]
Werner Schindler, Franois Koeune, and Jean-
Judge's note: The page 13 crop shows "Franois" in both [21] and [22] and "Francois Koeune" in [4]. The dropped ç is visible in the printed page, so this is not an extraction artefact.
Second check: none (judge only)