The practical impact is nil... for now. The attack is of a type known as side channel in that it exploits an information leak, here sound emission which depends on the processed data, including the private key. Under certain conditions, the leak might be leveraged into a full key recovery, but the conditions are not easily achieved in practice. As the authors say:
To apply the attack to GnuPG, we found a way to cause GnuPG to automatically decrypt ciphertexts chosen by the attacker. The idea is to use encrypted e-mail messages following the OpenPGP and PGP/MIME protocols. For example, Enigmail (a popular plugin to the Thunderbird e-mail client) automatically decrypts incoming e-mail (for notification purposes) using GnuPG. An attacker can e-mail suitably-crafted messages to the victims, wait until they reach the target computer, and observe the acoustic signature of their decryption (as shown above), thereby closing the adaptive attack loop.
In other words it takes a rather specific context for the attack to do real damage, and it won't be discreet.
Protection against leaks is done by altering the software so that leakage no longer occurs, or, more accurately, no longer yields usable information. In the case of RSA, for modulus n, public exponent e and private exponent d, blinding is effective:
- Before using the private key on input m, generate a random r modulo n.
- Compute m' = m*re mod n.
- Apply the core exponentiation on m', yielding t' (t' = m'd mod n).
- Compute t = t'/r mod n. This value t is the actual result: t = md mod n.
Why blinding is effective against most side-channel leaks in RSA is a matter of subtlety; but, in a hand-waving way, let's say that the added randomness of the r value (called the "mask") hides the data by preventing the attacker from modelling it: the attacker no longer knows what enters the exponentiation. It is important that a new mask r is generated for each exponentiation (to some extent, there can be shortcuts to produce sequences of masks at a lower cost, but that's tricky and usually not worth the effort). The overhead implied by blinding remains small, because the public exponent e is small.
Blinding is not the only counter-measure; to avoid leaks, one should also take care to keep the sequence of operations as fixed as possible, regardless of the data (e.g. in a classical square-and-multiply exponentiation algorithm, don't multiply conditionally; instead, always multiply, but conditionally keep the result or discard it).