The Sounds Your Computer Makes Can Give Away Your Encryption Keys

Illustration for article titled The Sounds Your Computer Makes Can Give Away Your Encryption Keys

You might think your computer runs quietly—or, if you're unlucky, noisily—but either way you probably wouldn't expect that its hum could give away your secrets. Turns out, that the noise your computer makes can reveal the RSA keys it's using.


A team of researchers from Tel Aviv University has been analyzing sound recordings made close to computers, and discovered that they can recover, bit by bit, private RSA keys. So how did they do it?

First, they identified that the sounds made by the computers they were recording revealed which processor instructions were running, reports Naked Security. As a result, they were able to tell if computer was adding or multiplying, which further allowed them to determine if one of a number of RSA keys were being used, just by listening in to the encryption of a fixed message using each key in turn.

Then came the real clever bit, as Naked Security explains:

The authors ultimately went much further, contriving a way in which a particular email client, bombarded with thousands of carefully-crafted encrypted messages, might end up leaking its entire RSA private key, one bit at a time.

Oh. Dear. Effectively, it's an exploit of an RSA quirk, which allows you to multiply a random number into the input before encryption then divide it out after decryption without affecting the result. That allows an attacker to add in a known quantity before encryption and remove it neatly afterwards—the only way to actually get anywhere with such an attack.

Admittedly, there's a rather large caveat here: it only works with GnuPG 1.4.x RSA encryption software, which is out of date, though that's not to say it's not sat on hundreds of thousands of computers still. So, an avoidable hack—but an utterly fascinating one, too. [Tel Aviv university via Naked Security]



How close do I have to be? Like a mic taped directly on the CPU?

"Hey, dude, I'll just tape this high sensitivity mic to your CPU, no biggie! I'm not suspicious at all! Ok, done, have a nice day!"

Also we are talking about CPU instruction speed here, so the device processing the mic's signal has to be faster than the CPU it's listening to! And we are talking about billions of instructions per second on multiple cores! It's like the brain trying to understand itself understanding itself...