Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I'm new to encryption and still learning about it; I overheard someone this weekend mentioning that 4096 bit encryption was "cracked" by listening to the CPU and searched for this to confirm it because it sounded a little hard to believe. However, at least if this article is legitimate, it appears to be true.

According to the article, the individual cracking it would need the ability to listen to the CPU that could decrypt the encryption, and it looks like that individual couldn't be too far away either:

The researchers successfully extracted decryption keys over a distance of four meters (13 feet) with a high-quality parabolic microphone. Perhaps more intriguingly, though, they also managed to pull of this attack with a smartphone placed 30 centimeters (12 inches) away from the target laptop. The researchers performed the attack on different laptops and desktops, with varying levels of success. For what it’s worth, the same kind of electrical data can also be divined from many other sources — the power socket on the wall, the remote end of an Ethernet cable, or merely by touching the computer (while measuring your body’s potential relative to the room’s ground potential)

From a security standpoint, are there any safeguards to protect against this outside what the article mentions ("heavy duty security and physical security")? I realize that to a certain degree some people will always try to break encryption, regardless of how many bits it is, but from someone on the protection side of things, what best practices do we have to prevent this type of encryption-hacking from occurring?

I forgot to add: one reason for this concern is that businesses/governments/powers-that-be could put a microphone by a CPU without users being aware so that they could obtain encryption information, and from there it's only a matter of hackers finding ways to get that information, as business/government/powers-that-be data are not always the most secure.

share|improve this question

marked as duplicate by Terry Chia, Lucas 'Paul' Kauffman, Ladadadada, Polynomial, AviD Dec 22 '13 at 12:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

In secret government agencies there is defence also against other side-channel attacks (e.g., electromagnetic). These protection mechanisms are usually physical: for example, they do not (or at least should not) use drywalls.

Other defences might be in re-implementing the algorithm, probably with some overhead.

Additionally, the attack is Chosen-Ciphertext-Attack. So you can just try to prevent your system from decrypting irrelevant messages (see in their paper how they did they CCA attack).

To conclude: Breaking cryptography by side channels is not something new. You can protect your self by adding physical protection or re-write the code (change the implementation) in order to prevent the side-channels.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.