I'm trying to wrap my head around this:http://m.cacm.acm.org/magazines/2016/6/202646-physical-key-extraction-attack... So to answer the question-- yes, the mic has to respond.  So if the worry is cellphone microphones, I simply don't see how the mic could deliver any useful data whatsoever to the analysis software. -Jonathan

On Sunday, June 5, 2016 8:07 PM, Matt Barber <brbrofsvl@gmail.com> wrote:

Will your mic respond? Or are the physics immaterial? On Sun, Jun 5, 2016 at 12:47 PM, Jonathan Wilkes via Pd-list pd-list@lists.iem.at wrote:

Hi list,Suppose a bird sings a song in a frequency range around 1gHz. (Yes, "g"Hz)

The song the bird sings is always exactly the same. The bird repeats its song several million times over the course of an hour. If I record at a sampling rate of 44.1kHz below the tree in which the bird is perched, for a duration of one hour, would I be able to recreate the bird's song? -Jonathan

Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list

Now I remember we used to do this when I was a kid.. It was my first adventure into computer music. Computers like the TRS80 didnt have soundcards (or even beepers), but if you put an AM radio nearby it was possible to make beeps and rhythm patterns by programming, shorter FOR loops, or less operations in the body... shorter and higher pitched sounds. It makes perfect sense to reverse this and figure out the code from the sound.

I think the method still needs a lot of time, Like collecting IVs for wifi cracking, the information is there, but dispersed amongst many many samples, so you need to

1. collect a LOT of data
2. analyse it to find how the side channel statistically encodes data/secrets

In the Genkin paper theres another important point;

Its an interactive attack, relying on "amplifying" side channel effects adaptively. Thats like being able to poke the bird and make it tweet (in Jonathan's original analogy). This is quite different from sampling a signal from a system non-interactively. If you get to ask questions you can bias answers. So triggering the "bird" to tweet relative to the low bandwidth sampling boundary allows us to probe data within the structure of a signal we could not possibly sample under Nyquist restrictions. a.

On Sun, Jun 05, 2016 at 08:38:19PM -0400, Matt Barber wrote:

Figure 6 in the link is measuring up to 20khz over about a half second, and showing some kind of step function in the spectrum halfway through. I've no idea what they're actually recording.

On Sun, Jun 5, 2016 at 8:21 PM, Jonathan Wilkes jancsika@yahoo.com wrote:

...

I'm trying to wrap my head around this:

http://m.cacm.acm.org/magazines/2016/6/202646-physical-key-extraction-attack...

So to answer the question-- yes, the mic has to respond. So if the worry is cellphone microphones, I simply don't see how the mic could deliver any useful data whatsoever to the analysis software.

-Jonathan

On Sunday, June 5, 2016 8:07 PM, Matt Barber brbrofsvl@gmail.com wrote:

Will your mic respond? Or are the physics immaterial?

On Sun, Jun 5, 2016 at 12:47 PM, Jonathan Wilkes via Pd-list < pd-list@lists.iem.at> wrote:

Hi list, Suppose a bird sings a song in a frequency range around 1gHz. (Yes, "g"Hz)

The song the bird sings is always exactly the same.

The bird repeats its song several million times over the course of an hour.

If I record at a sampling rate of 44.1kHz below the tree in which the bird is perched, for a duration of one hour, would I be able to recreate the bird's song?

-Jonathan

---

Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list

---

Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list

On Mon, Jun 06, 2016 at 04:03:28PM +0000, Jonathan Wilkes wrote:

...

of a signal we could not possibly sample under Nyquist restrictions.

But a public-facing server would regularly be "tweeting", no?

Or posting on Facebook? :) a.

Hi Jonathan,

On 06/06/16 08:21, Jonathan Wilkes via Pd-list wrote:

I'm trying to wrap my head around this: http://m.cacm.acm.org/magazines/2016/6/202646-physical-key-extraction-attack...

So to answer the question-- yes, the mic has to respond. So if the worry is cellphone microphones, I simply don't see how the mic could deliver any useful data whatsoever to the analysis software.

As Andy pointed out, the situation you describe with the birdsong is not analogous this attack and his AM radio for-loop rig on the TRS-80 is much closer.

The useful data does not occur in the GHz range: PGP decryption on a 4096 bit key takes on the order of tens or hundreds of milliseconds. The spectrum of that many-millisecond event varies depending on the adaptively-crafted cyphertext that has been sent. For each bit of the secret a crafted cyphertext is sent which causes the multi-millisecond decryption process to yield a recognisable frequency spectrum depending on whether the bit of the secret key they are cracking is a 0 or a 1. This happens using exactly the mechanism Andy describes - different operations executed repeatedly in loops inside the decryption library. They also coerce the algorithm to amplify the effect using the same technique affecting a different portion of the code.

So they send 4096 individually and adaptively crafted cyphertexts designed to provoke the algorithm to behave in one way or another depending on whether a 0 or a 1 is present in the secret key at each position, and they measure the acoustic frequency spectrum of the multi-millisecond decryption of each cyphertext to determine whether it's a 0 or 1 at that position.

This works because the decryption algorithm will run different bits of code depending upon a) the crafted cyphertext input b) the secret key.

"In some cases, it even suffices to record the target through the built-in microphone of a mobile phone placed in proximity to the target and running the attacker's mobile app."

I'm guessing the "some cases" where it is possible depend on the quality of the phone mic and the level of accoustic leakage of the target device.

But a public-facing server would regularly be "tweeting", no?

Note that it's not just a matter of the server emitting the "tweets" as you describe them - you have to actively prompt it to emit a certain type of biased accoustic signature for each bit of the secret key and then examine the audio spectrum of the decryption event to see what the value of the bit actually was.

The acoustic attack works on any target device that you can compel to perform a decryption of some cyphertext multiple times, and that leaks accoustic side-band information that you can collect. So you'd need physical access to a public-facing server (in which case several other classes of attacks may be more feasible) in order to collect the acoustic signature.

Although maybe you could do this:

https://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804

The attack in the paper was on GnuPG but if SSH or HTTPS implementations are similarly vulnerable to this attack then you could provoke the server to perform a decryption several times easily without any human intervention since unlike GnuPG those servers decrypt in a completely automated way.

They mention OpenSSL explicitly in the conclusion:

"Turning to mobile phones and tablets, as well as to other cryptographic libraries (such as OpenSSL and iOS CommonCrypto), electromagnetic key extraction from implementations of the Elliptic Curve Digital Signature Algorithm has also been demonstrated, including attacks that are non-invasive, low-bandwidth, or both."

Dan Bernstein's NaCl crypto library (elliptic curve not prime factorization) is specifically designed to avoid some of these pitfalls:

https://cr.yp.to/highspeed/coolnacl-20120725.pdf

"NaCl features: no data flow from secrets to load addresses; no data flow from secrets to branch conditions; no padding oracles; centralizing randomness; avoiding unnecessary randomness; extremely high speed; and cryptographic primitives chosen conservatively in light of the cryptanalytic literature."

Fascinating paper, thanks for sharing.

Cheers,

Chris.

On 07/06/16 13:40, Chris McCormick wrote:

On 07/06/16 12:22, Chris McCormick wrote:

...

...

But a public-facing server would regularly be "tweeting", no?

So you'd need physical access to a public-facing server in order to collect the acoustic signature.

https://www.tau.ac.il/~tromer/acoustic/

Here the same authors mention this attack:

"Send your server to a colocation facility, with a good microphone inside the box, and then acoustically extract keys from all nearby servers."

Oh and on that same page they address your question directly in a way that is far better and more succinct than I did:

Q8: How can low-frequency (kHz) acoustic leakage provide useful information about a much faster (GHz)?

Individual CPU operations are too fast for a microphone to pick up, but long operations (e.g., modular exponentiation in RSA) can create a characteristic (and detectable) acoustic spectral signature over many milliseconds. In the chosen-ciphertext key extraction attack, we carefully craft the inputs to RSA decryption in order to maximize the dependence of the spectral signature on the secret key bits. See also Q18.

For the acoustic channel, we can't just increase the measurement bandwidth: the bandwidth of acoustic signals is very low: up to 20 kHz for audible signals and commodity microphones, and up to a few hundred kHz using ultrasound microphones. Above a few hundred kHz, sound propagation in the air has a very short range: essentially, when you try to vibrate air molecules so fast they just heat up, instead of moving in unison as a sound wave.

Cheers,

Chris.