In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values:
$T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$
$T_0 = T_M - \omega ExpTMult$
where $T_M$ is the timing for $y^x\ mod\ m$, $TMult$ the timing for the multiplication, $\omega$ the Hamming weight of the exponent and $ExpTMult$ the expected timing value for a multiplication. We calculated these values for every sample. Then, if $\Sigma_{sample} T_1\ <\ \Sigma_{sample} T_0$ the LSB is likely 1. Similar for the following bits.
Question: What happens after a incorrect guess?
The linked paper says (Sec. 3):
after an incorrect exponent bit guess, no more meaningful correlations are observed.
So, it is $\Sigma T_1 \approx \Sigma T_0 $ for the following bits?
