Consider the "simple" timing attack on RSA discussed in Section 6.6.1. a. Extend the timing attack to recover the bit d ? ,. That is, assuming that bit d 1 has been recovered, what conditions must Y...

Consider the "simple" timing attack on RSA discussed in Section 6.6.1.

a. Extend the timing attack to recover the bit d_?,. That is, assuming that bit d₁
has been recovered, what conditions must Y and Z satisfy so that the attack presented in the text can be used to determine d₂?

b. Extend the attack to recover d₃, assuming that d₁nd d₂
have been recovered.

c. In practice, we need to recover about half of the private key bits. Why is this attack not a practical means for recovering such a large number of private key bits?