back to article Code-busters lift RSA keys simply by listening to the noises a computer makes

Computer scientists have shown how it might be possible to capture RSA decryption keys using the sounds emitted by a computer while it runs decryption routines. The clever acoustic attack was developed by Adi Shamir (the "S" in RSA) of the Weizmann Institute of Science along with research colleagues Daniel Genkin and Eran …

COMMENTS

This topic is closed for new posts.
  1. Don Jefe

    Neat

    That's good work on their part. It's really neat, if nothing else.

    It doesn't seem like it would be overly hard to prevent though. I know board rooms and other areas, like at some US embassies, have window frames that introduce random frequency and vibration to the windowpanes to prevent laser based audio surveillance. Those systems use the unique sounds created by every central HVAC system as the key for their randomness as it can't be duplicated and filtered out unlike math based randomness generators can (in theory anyway). I don't see why something similar couldn't be introduced in computers, for those who are concerned.

    1. Cliff

      Re: Neat

      Yes, neat. Easily defeated but impressive to be able to implement it in the real world to begin with.

      Laser/windows - I recall an old electronics tutor's tale of the development of that system, when they used a mirror on a sheet of latex for initial lab conditions. They got through a lot of latex, one of the best/easiest/cheapest sources at the time was condoms. Cue some lab junior going to the chemist to ask for a gross of condoms, being asked if he wanted the ones with or without the teat, and responding that he didn't mind as he was going to cut the ends off before using them anyway. One concerned pharmacy assistant.

    2. Michael Wojcik Silver badge

      Re: Neat

      Blocking one covert channel is spot defense, and just leaves you open to other channels. It's the wrong approach. Blinding is the right fix, as we've known for at least 15 years (since Kocher published his work on power-channel attacks). Mask the signal, not the channel.

  2. Mark Allen

    Other White Noise

    So in a room full of computers, Plasma TV screens, monitors, microwave oven and a HiFi crunching out electronic music all while living in a basement I assume makes the chaotic computer user harder to listen in to than the guy who owns one computer and one mobile phone?

    Which reminds me... I still haven't worked out which device at the front of my house blasts out so much white noise I can't hear MW or LW on my car radio when it is parked outside the door. A little odd as when I use radios in the house it is fine... unless I fire up the Plasma TV.

  3. LordHighFixer

    Back in the day

    We used to put an AM radio next to the computer, tuned the radio to an appropriate blank spot on the band, and ran a program that, due to the timing loops and other tricks, would play "stairway to heaven", and other popular tunes of the day.

    So now, 40+ years later, some super crypto genius has discovered that if you send a computer known quantities of data you can analyze what it is doing by the EMI it generates.

    Next in the news, "round things have less friction than square things", astonishing results of 10 year research project.

    1. Anonymous Coward
      Anonymous Coward

      Golly! Is the air thin up there, where you look down on Shamir?

      Every man and his dog knew of EMI interference and used it for tunes (see also: floppy drive symphonies, dot matrix printers, etc) or to communicate code state when no other output is possible (tight loop for N seconds to leak a debug value, etc). But this "super crypto genius" (you got that right) isn't dealing with EMI from code under his control - this is using real audible sound (coming largely from the power regulator in the laptop dancing around with the likes of Intel SpeedStep and voltage scaling) to extract the complete state from a complex and intentionally hard-to-analyse system. And demonstrated it for real, not just as a thought experiment. Frankly I'd be well chuffed to have pulled that off, and had I been asked if it was possible would have doubtless said "nope".

      And as a petty snark on "round things have less friction than square things" notion - just leave your handbrake on and take the car for a quick push along the road... (wheels are good but it's not directly about friction)

      1. John Brown (no body) Silver badge

        Re: Golly! Is the air thin up there, where you look down on Shamir?

        "this is using real audible sound (coming largely from the power regulator in the laptop dancing around with the likes of Intel SpeedStep and voltage scaling) to extract the complete state from a complex and intentionally hard-to-analyse system."

        Although it is impressive, I wonder how much data is actually being interpreted/interpolated from the samples and how much is linked to a fingerprint database in a similar way to how submarines can detect not just ships or other subs from their engine/screw noises but which make/model/class and sometimes an exact named vessel.

        This may not be so much of a technological breakthrough as an advancement and/or application of existing technology and methods to a similar problem.

    2. dan1980

      Re: Back in the day

      @LordHighFixer

      Perhaps read the paper before pooh-poohing the results; it specifically mentions (3.3) that they ruled out EMI and confirmed the readings were from 'acoustic emanations'.

      Beyond just the fun-and-games you mention with EMI, testing for vulnerabilities to EMI side-channel attacks is common enough that there is no way the authors didn't know about this. Indeed, there are even competitions to see who can retrieve keys from chips using EMI analysis.

      One of the implications of this work is that a side-channel attack using sound could, potentially, be conducted at distance. They managed 4m with a parabolic reflector but, as the signal is audible, any method that captures audio with sufficient sensitivity should work. In the paper, they indicate that they plan to use a laser vibrometer in future tests!

      Other scenarios they describe include bugging/tapping a phone conversation and using a computer's own microphone. The latter would not be overly difficult and would be ideal where someone is using, for example, Skype.

      The mature nature of EMI side-channel research means that there are existing measures for protection against such attacks, but machines so protected would still be vulnerable to acoustic analysis, which opens numerous attack vectors, some of which could be very covert.

      Of course, it's not just a matter of 'record sounds, get data' but the principle has been proven.

    3. This post has been deleted by its author

    4. phuzz Silver badge
      Boffin

      Re: Back in the day

      It's not just a case of record sounds-get data. They also had to feed known plaintext into the system to get more of the key, so it was closer to record sounds-analyse data-send more data to be encrypted-record more sounds.

    5. clatters
      Childcatcher

      Re: Back in the day

      I've heard exactly these tunes from an IBM 360 when I were nobbut a lad, where the core resonated at different frequencies to produce sound. Younger readers should now Yahoo! or DuckDuckGo (trying to start a new trend here) "magnetic core"

      1. vatpiledon

        Re: Back in the day

        Yes, in my teens (Early 80's) repaired core memories, the only ones that had the equipment to do this in the UK. They used to hum tremendously and blow up because of resonance and blown transistors... I seem to remember. Later in 1984 at Broadcasting House, worked on repairing valve ampliers, where the gain was so high, that the valves were microphonic. Now I feel like an even older fart!

        Great article though!

        East to see some hackers trying this together with a whole arsenal of other vulnerabilities to supplement their hoard of stolen bitcoins, where the value of data gathered is worth LOAD$AMONEY.....again only oldies would understand Harry what-is-name punchline.

    6. Grandpa Tom

      Re: Back in the day

      Back in the day [70's and 80's] we were coating the inside of plastic CRT terminal covers with SILVER. Uncle Sam knew that you could potentially read the text as it was typed on the display from outside the room.

      We offered a cheaper coating (Zink) but that did not satisfy them.

  4. John Smith 19 Gold badge
    Happy

    But will it help you decrypt Sky Digital

    Enquiring minds.....

    1. Adam 1

      Re: But will it help you decrypt Sky Digital

      Yes. All you would need is a microphone next to the set top box and a webcam feed from your local sewage works for an hour or so.

  5. phil dude
    Linux

    lampton protection principle...

    That was something I read about when doing my Msc. The example they gave was modulating electrical signals, but it basically means any connection to the outside world is theoretically a side channel route.

    Plus A.Tannenbaum's sarcastic take on passwords ;-)

    A publication of A. Shamir is well worth reading...

    P.

  6. JaitcH
    Happy

    Back in the day ...

    we used to play 'tunes' on printers, computers (replicated on transistor radios) and other peripherals - on the evening / night shifts.

    Musty have cost the employer a fortune in manpower and computer time!

  7. Douglas Crockford

    Digital Rights Management

    This is a problem for DRM systems. A DRM system wants to keep secrets from the owner of a device (such as you). This technique allows the owner of a device (you) to ultimately have control over your own stuff. Yes, you.

    1. Crazy Operations Guy

      Re: Digital Rights Management

      Um, no.

      This attack requires detailed knowledge of the unencrypted data and the underlying algorithm itself, of which you have neither in a DRMed system

      1. seven of five

        Re: Digital Rights Management

        > of which you have neither

        yet.

      2. Adam 1

        Re: Digital Rights Management

        Plus well if your goal is to get access to the unencrypted sound wave for a song and all you have is a microphone and a computer *playing the song* there are probably easier ways to get it.

  8. dan1980
    Thumb Up

    Congratulations - excellent work!

    Seriously - nice job. That is some impressive, impressive work.

    As several people have mentioned above, EMI is one thing (and a pretty well known thing) but using coil whine* as a reliable indicator of what functions the CPU is performing and refining that to find a 4096-bit key? Like I said: impressive.

    Of course, they then took this further, realising that, as the source of information was seemingly voltage regulation, there should be ways to measure this more directly. In one of their experiments they get the same information from connecting a voltage probe to a CAT5 cable connected to a switch - at the switch end. As they rightly point out, that can be in another room, far from the user's gaze and doesn't actually interrupt use of the network. As the information is coming from the potential of the shield, you don't even need the port to be enabled on the laptop.

    Even more amazing is being able to measure this indirectly by measuring the potential of someone touching the laptop chassis!

    Again - very, very impressive work and they should be suitably proud of it.

    Maybe not directly useful given the restrictions but they have proved a general property - that CPU operations can be reliably ascertained from analysing the voltage regulation.

    * - What people call 'coil whine' is not always generated by the coils themselves, as the paper identifies. More generally, it is the power supply/regulation circuits that are responsible. It doesn't seem to matter what is actually responsible, nor that they know what component/circuit it is.

    1. Charles Manning

      Sounds fishy.

      Back in 1985 I worked on an Apollo workstation with a squeaky coil in the power supply. You could hear the squeak change pitch/volume as the load changed (eg. looping etc).

      But to recreate keys from that sounds like a stretch, except in highly contrived hardware assembled to support a theory.

      Most power supplies etc are very well decoupled from the coils. There are also caches and other loads playing havoc with the load, so it is hard to believe that exact CPU instructions can be determined.

      The other part that makes this sound iffy, is that most CPUs are multi-core, executing and GHz. The phone microphone is bandwidth limited to a few kHz. It just does not have the bandwidth to convey the amount of data implied by decoding instructions that fast.

      1. Bronek Kozicki

        Re: Sounds fishy.

        They do it one small part at a time, so the bandwidth of the output channel is not relevant. This is also why there's a requirement that a large number of messages must be decrypted without human intervention and that these messages are crafted in the real time based on previous results.

    2. Charles 9

      Re: Congratulations - excellent work!

      "Of course, they then took this further, realising that, as the source of information was seemingly voltage regulation, there should be ways to measure this more directly. In one of their experiments they get the same information from connecting a voltage probe to a CAT5 cable connected to a switch - at the switch end."

      That's an interesting feat, given that CAT5 cables are UNshileded (being a UTP cable).

  9. Archimedes_Circle

    All,

    I think it is worth pointing out that while 2.x does include blinding schemes to avoid side channel leakage, as of http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html so does gpg 1.4.16, which was added following private contact by one of the researchers.

    As for those wondering why it was left out, previously local LAN attacks allowed sidechannel leakage to exploit this but there was no other vector known until this paper. However gpg 1.x isn't designed for such purposes therefore it was left out. Doesn't mean someone did not deploy it incorrectly, but gpg has always been rather conservative.

  10. Turtle

    As I Attempt to Imagine To Myself...

    Attempting to imagine to myself a scenario where this type of attack could be carried out in the real world, it seems that, no matter how hard I try, the victim always turns out to be Lou Costello.

  11. Lottie

    Hmmm

    If they used a microphone and the computers in my office to test this out, they'd come away thing "forfuxachehurryup" was part of every single key.

  12. SmokyBacon
    Pirate

    Somethign like this presented at BH2012

    Something similair was done by Valeria Bertacco at Black Hat 2012

    Search for BlackHat 2012 Torturing OpenSSL to see the detail of the RSA attack using hardware vulnerabilities on the server (voltage modification).

  13. Michael Wojcik Silver badge

    The private key to be broken can't be password protected because that would mean a human would need to intervene to open every message.

    Not exactly true; it's not uncommon to have the private key stored durably in encrypted form, but decrypted on first use after boot and kept in unencrypted form (possibly obscured) in memory while the system is up.

    In any case, this is just a special case of the constraint that messages need to be decrypted automatically, and that only because of the volume of messages. It's a pretty meaningless caveat.

This topic is closed for new posts.

Other stories you might like