3 ms·

Note that we are talking about a single RSA operation. So attacks that require repeated trials are not relevant here.