RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis

Abstract

Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer, and in particular leak sensitive information about security-related computations. In a preliminary presentation (Eurocrypt'04 rump session), we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was that the acoustic side channel has a very low bandwidth (under 20 kHz using common microphones, and a few hundred kHz using ultrasound microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers.In this paper we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away.Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables. * The authors thank Lev Pachmanov for programming and experiment support during the course of this research.

Why Cryptography Should Not Rely on Physical Attack Complexity

“…Accordingly, a great deal of research is conducted to find out which side channels can be used [77,138] and how they can be optimally exploited [91]. Different algorithms are analyzed with respect to their susceptibility towards these attacks [33,99,141].…”

“…In 2013, the acoustic side channel was presented [77]. The authors show how a 4096-bit RSA key can be extracted by analyzing the acoustic frequency spectrum during decryption.…”

“…Only recently two more assessments of physical complexity proved to be wrong: the acoustic side channel and cloning of PUFs. The acoustic side channel, which exploits variations in the sound generated by a computer, was known for ten years, but it has not been taken seriously until practical results were presented in 2013 [77]. Measuring acoustic emanations with a sufficient signal strength was considered impossible with a good quality due to the low bandwidth and the low emission strength of this side channel.…”

Low-Level Attacks in Bitcoin Wallets

“…Applying them in practice is a matter of adapting them to the corresponding hardware implementation. The security of microcontrollers has been extensively examined, and a number of fault and side-channel attacks have been found, e.g., [4,12,20,21]. Therefore, we focus on smart-card based wallets, which provide guarantees against physical and interdiction attacks and have traditionally been used for key management and cryptographic operations.…”

Leakage-Resilient Circuits Revisited – Optimal Number of Computing Components Without Leak-Free Hardware

“…Passive side-channel attacks, or leakage attacks, such as timing attacks, power analysis attacks, acoustic attacks, and more [1,6,24,30,36,37], have proven highly detrimental. Indeed, it has been shown that leakage attacks can be used to recover the entire secret key in common implementations of the RSA [25], AES [45] and DES [35] cryptosystems. These attacks are not just theoretical, and can be launched in complex, reallife settings, e.g.…”