Hey, is that a parabolic antenna in your pocket or are you just happy to see my laptop?
This is some scary stuff….for all of us. It is now possible to extract your encryption keys using a cellphone, antenna and some other ways like simply touching your machine or attaching a cable. The sounds eminating from your computer gives away your encryption while your computer is decrypting data.
See how it’s done: RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysisdt@infootnoteThe authors thank Lev Pachmanov for programming and experiment support during the course of this research.dt@infootnote – acoustic-20131218.pdf
Abstract
Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer, and in particular leak sensitive information about security-related computations. In a preliminary presentation (Eurocrypt’04 rump session), we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was that the acoustic side channel has a very low bandwidth (under 20kHz using common microphones, and a few hundred kHz using ultrasound
microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers.
- In this paper we describe a new acoustic cryptanalysis.key extraction attack, applicable to
GnuPG’s current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.
The paper’s authors demonstrated an “attack” running in a lecture hall, and suggested other plausible scenarios:
The techniques the authors describe can be countered by sound dampening, but the white noise of a PC’s fan can be pretty easily filtered out. The researchers said that they supplied their attack vector to GnuPG developers before publication, let them develop revised code, and yet it was still vulnerable. The answer may lie in using software to try and obfuscate the audible sound emanations, they said
