On 07/06/16 13:40, Chris McCormick wrote:
On 07/06/16 12:22, Chris McCormick wrote:
But a public-facing server would regularly be "tweeting", no?
So you'd need physical access to a public-facing server in order to collect the acoustic signature.
https://www.tau.ac.il/~tromer/acoustic/
Here the same authors mention this attack:
"Send your server to a colocation facility, with a good microphone inside the box, and then acoustically extract keys from all nearby servers."
Oh and on that same page they address your question directly in a way that is far better and more succinct than I did:
Q8: How can low-frequency (kHz) acoustic leakage provide useful information about a much faster (GHz)?
Individual CPU operations are too fast for a microphone to pick up, but long operations (e.g., modular exponentiation in RSA) can create a characteristic (and detectable) acoustic spectral signature over many milliseconds. In the chosen-ciphertext key extraction attack, we carefully craft the inputs to RSA decryption in order to maximize the dependence of the spectral signature on the secret key bits. See also Q18.
For the acoustic channel, we can't just increase the measurement bandwidth: the bandwidth of acoustic signals is very low: up to 20 kHz for audible signals and commodity microphones, and up to a few hundred kHz using ultrasound microphones. Above a few hundred kHz, sound propagation in the air has a very short range: essentially, when you try to vibrate air molecules so fast they just heat up, instead of moving in unison as a sound wave.
Cheers,
Chris.