Remote RSA Timing Attacks Practical

David Brumley and Dan Boneh writes "Timing attacks are usually used to attack weak computing devices such as smartcards. We show that timing attacks apply to general software systems. Specifically, we devise a timing attack against OpenSSL. Our experiments show that we can extract private keys from a OpenSSL-based server such as Apache with mod_SSL and stunnel running on a machine in the local network. Our results demonstrate that timing attacks against widely deployed network servers are practical. Subsequently, software should implement defenses against timing attacks. Our paper can be found at Stanford's Applied Crypto Group."

Comments

Crypto for Idiots

[photonrider]

Is there an english translation of this anywhere? I read the paper and there's lots of impressive looking formula's and stuff in there but I don't see how figuring out how long it takes to decrypt/encrypt something can tell you what it is. Doesn't make sense to me.