Proper acoustic shielding, using acoustic absorbers and sound-proof enclosures, would attenuate the signals, thereby reducing the attacker’s signal-to-noise ratio and thus making the attack’s cost or time. However, this raises costs in design and in air circulation for cooling. In particular, laptop cooling fan vent holes are typically a prolific source of emanations, and cannot be easily blocked. We also observe that the external "power brick" power supplies of some laptops also seem to exhibit computation-dependent acoustic emanation, and thus likewise require engineering attention and mitigation.
Noisy environment.
One may expect that placing the machine in a noisy machine will foil the attack. However, the energy of noise generated in a typical noisy environment (such as outdoors or a noisy room) is typically concentrated at low frequencies, below 10kHz. Since the acoustic leakage is usually present well above this rage, such noises can be easily filtered out during the data acquisition process using a suitable high-pass filter (as we did in our experiments). Also, the signal would be observe during any pauses in ambient noise (e.g., music). Note also that the attacker may, to some extent, spectrally shift the acoustic signal to a convenient notch in the noise profile, by inducing other load on the machine (see below). Thus, a carefully-designed acoustic noise generator would be required for masking the leakage.
Parallel software load.
A natural candidate countermeasure is to induce key-independent load on the CPU, in hope that the other computation performed in parallel will somehow mask the leakage of the decryption operation. Figure 28 demonstrates the difference in the frequency spectra of the the acoustic signature of the second modular exponentiation during our attack resulting from applying a background load comprised of an infinite loop of ADD instructions being performed in parallel. As can be seen from Figure 28, background load on the the CPU core affects the leakage frequency by moving it from the 35–38kHz range to the range of 32–35kHz. In fact, this so called "countermeasure" actually might help the attacker since the lower the leakage frequency is the more sensitive microphone capsule can be used in order to perform the attack (see Section 5.4).
Cipher text randomization.
One countermeasure that is effective in stopping our attack is RSA ciphertext randomization. [...] In this case, the value sent to the modular exponentiation routine is completely random, thus preventing our chosen cipher text attack. This countermeasure has a nontrivial cost, since an additional modular exponentiation is required (albeit with the exponent e, typically small). Also, it does not affect key distinguishability, which is independent of the ciphertext.
Modulus randomization.
Another standard side-channel countermeasure, which may help against both key distinguishing and key extraction, is to randomize the modulus during each exponentiation. [...]
Cipher text normalization.
[...] This observation yields an immediate countermeasure to our attack. [...] This too foils our key recovery attack (but not
key distinguishing).
[^] # Re: Mais ...
Posté par Pierre Roc . En réponse au journal La crypto ça sert plus à rien de toute façon. Évalué à 1.
Acoustic shielding.
Proper acoustic shielding, using acoustic absorbers and sound-proof enclosures, would attenuate the signals, thereby reducing the attacker’s signal-to-noise ratio and thus making the attack’s cost or time. However, this raises costs in design and in air circulation for cooling. In particular, laptop cooling fan vent holes are typically a prolific source of emanations, and cannot be easily blocked. We also observe that the external "power brick" power supplies of some laptops also seem to exhibit computation-dependent acoustic emanation, and thus likewise require engineering attention and mitigation.
Noisy environment.
One may expect that placing the machine in a noisy machine will foil the attack. However, the energy of noise generated in a typical noisy environment (such as outdoors or a noisy room) is typically concentrated at low frequencies, below 10kHz. Since the acoustic leakage is usually present well above this rage, such noises can be easily filtered out during the data acquisition process using a suitable high-pass filter (as we did in our experiments). Also, the signal would be observe during any pauses in ambient noise (e.g., music). Note also that the attacker may, to some extent, spectrally shift the acoustic signal to a convenient notch in the noise profile, by inducing other load on the machine (see below). Thus, a carefully-designed acoustic noise generator would be required for masking the leakage.
Parallel software load.
A natural candidate countermeasure is to induce key-independent load on the CPU, in hope that the other computation performed in parallel will somehow mask the leakage of the decryption operation. Figure 28 demonstrates the difference in the frequency spectra of the the acoustic signature of the second modular exponentiation during our attack resulting from applying a background load comprised of an infinite loop of ADD instructions being performed in parallel. As can be seen from Figure 28, background load on the the CPU core affects the leakage frequency by moving it from the 35–38kHz range to the range of 32–35kHz. In fact, this so called "countermeasure" actually might help the attacker since the lower the leakage frequency is the more sensitive microphone capsule can be used in order to perform the attack (see Section 5.4).
Cipher text randomization.
One countermeasure that is effective in stopping our attack is RSA ciphertext randomization. [...] In this case, the value sent to the modular exponentiation routine is completely random, thus preventing our chosen cipher text attack. This countermeasure has a nontrivial cost, since an additional modular exponentiation is required (albeit with the exponent e, typically small). Also, it does not affect key distinguishability, which is independent of the ciphertext.
Modulus randomization.
Another standard side-channel countermeasure, which may help against both key distinguishing and key extraction, is to randomize the modulus during each exponentiation. [...]
Cipher text normalization.
[...] This observation yields an immediate countermeasure to our attack. [...] This too foils our key recovery attack (but not
key distinguishing).