X-Nico

Side channel attack

In the case of RSA decryption with secret exponent $d$ and corresponding encryption exponent $e$ and modulus $m$, the technique applies as follows (for simplicity, the modular reduction by m is omitted in the formulas): before decrypting; that is, before computing the result of $y^d$ for a given ciphertext $y$, the system picks a random number $r$ and encrypts it with public exponent $e$ to obtain $r^e$.

see also