Side-Channel Attacks on Textbook RSA and ElGamal Encryption

This paper describes very efficient attacks on plain RSA encryption as usually described in textbooks. These attacks exploit side channels caused by implementations that, during decryption, incorrectly make certain assumption on the size of message. We highlight different assumptions that are easily made when implementing plain RSA decryption and present corresponding attacks. These attacks make clear that plain RSA is a padding scheme that has to be checked carefully during decryption instead of simply assuming a length of the transported message. Furthermore we note that the attacks presented here do also work against a similar setting of ElGamal encryption with only minimal changes.