GoKawiilResearcher Colin Percival disclosed cache-timing side-channel attack on RSA in 2005
A security researcher found that cache timing information leaked enough data to reconstruct a full RSA private key, and spent six months privately coordinating with vendors before going public. He presented the findings at BSDCan on May 13, 2005, with advisories issued around the same time by FreeBSD, NetBSD, Red Hat, SCO and Ubuntu. Intel reportedly pressured Yahoo to have him withdraw the paper, but Yahoo noted it had no employment relationship with him to leverage.
GoKawiil's interpretation of the reporting above, not reported fact.
The episode is an early, concrete example of coordinated vulnerability disclosure across multiple operating system vendors, a practice that later became industry standard. It also illustrates how commercial pressure from a major chipmaker can be brought to bear on independent researchers, and how the absence of an employer-employee relationship can shield a researcher from such pressure. The account suggests side-channel attacks were already a serious concern to agencies like the NSA well before they became widely publicized.
- A cache-timing side channel could leak enough bits to fully reconstruct an RSA private key.
- The researcher spent six months privately coordinating disclosure with vendors before going public on May 13, 2005.
- Intel allegedly tried to pressure the researcher via Yahoo to withhold publication, but had no actual leverage over him.
Source: daemonology.net, 2026-10-31
Published there as: “The Duty of a Scholar”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.