Security

5010 readers

1 users here now

Confidentiality Integrity Availability

founded 4 years ago

MODERATORS

It is possible to extract encryption keys by recording coil whine with a phone next to the computer (2013 paper) (web.archive.org)

submitted 10 months ago* (last edited 10 months ago) by [email protected] to c/[email protected]

7 comments fedilink hide all child comments

A more TLDR article about this: https://www.extremetech.com/defense/173108-researchers-crack-the-worlds-toughest-encryption-by-listening-to-the-tiny-sounds-made-by-your-computers-cpu

FAQs from the researchers: https://web.archive.org/web/20230130225254/http://www.cs.tau.ac.il/~tromer/acoustic/

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 7 points 10 months ago (2 children)

It only works on chosen cyphertexts. They don't specify is that means "any file, but the attacker has to get access to it" or if it means "this very specific file that we made in order to do this attack".

The former being much more dangerous than the latter of course.

[–] [email protected] 5 points 10 months ago

According to the FAQ:

The key extraction attacks finds the secret key bits one by one, sequentially. For each bit, the attacker crafts a ciphertext of a special form, that makes the acoustic leakage depend specifically on the value of that bit. The attacker then triggers decryption of that chosen ciphertext, records the resulting sound, and analyzes it.

Which sounds to me like the latter?

[–] [email protected] 1 points 10 months ago

but, you surely will agree, this is pretty devastating for any target. known cleartext may be trivial to insert into a targets workflow, and the confirmed recovery of a private key is potentially a massive payoff.

the ability to process and extract sensitive information from the local environment has gotten seriously scary.