Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack the world’s toughest encryption

extremetech.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Researchers crack the world’s toughest encryption

#11

Post by ReidZB »

andr wrote: post #4

Perhaps this can be thwarted by adding randomization to algorithm implementations so calculations are performed in different order every time.

I haven't had time to delve into the details of this attack, but I do want to note that adding randomization usually doesn't do much for security in these situations. Essentially, randomization usually just increases the number of samples needed for the attack, so it just ups the computational cost a bit. The same is true in timing attacks, for example, and I very strongly suspect that's the case here too.

The authors give some ideas for mitigation, however, in section 11 of their paper [1] (appropriately titled "Mitigation").

[1] http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf

Re: Researchers crack the world’s toughest encryption

#13

Post by exo762 »

There is a patch for that in GnuPG, available in both Debian and Ubuntu. Update your machines :)

FLOSS is amazing. One day since research paper and your machines are already patched. This means that probably no one had enough time to actually use this attack vector in the wild.

Re: Researchers crack the world’s toughest encryption

#15

Post by upofadown »

eterm wrote: post #12
onion2k wrote: post #5

Being hugely pedantic, the "world's toughest encryption" is a one-time pad, and they didn't crack that.

Would the same method not work against a one-time pad?

Correct. The same method would not work against a one-time pad. The processor would do exactly the same operation for each and every byte of message and key. The power consumed would not change in any significant way.

Re: Researchers crack the world’s toughest encryption

#16

Post by drblast » 

  >or you need to use a “sufficiently strong wide-band noise 
  >source.” Something like a swooping, large-orchestra 
  >classical concerto would probably do it.
Unless you're standing next to a live orchestra that's playing the concerto on specially designed dog-whistles, you're going to have a pretty hard time masking anything near the 150 kHz range.

Re: Researchers crack the world’s toughest encryption

#19

Post by onion2k »

eterm wrote: post #12
onion2k wrote: post #5

Being hugely pedantic, the "world's toughest encryption" is a one-time pad, and they didn't crack that.

Would the same method not work against a one-time pad?

I was pointing out that they didn't, not that they couldn't. But I don't believe they could anyway. Deciphering a OTP is absolutely trivial if you have the key. You're just doing modular addition, and that's something computers do a great deal of during the course of running stuff. Even assuming a reasonably long ciphertext of 500 characters, that'd take only 1000 operations (an add and a mod 10) - any modern CPU could do that in fractions of a millisecond. The deciphering operation wouldn't even register above idling.

Additionally, there's the problem that there isn't a 'industry standard' OTP app, so there'd be no reference fingerprint to look for.

I would love to be proved wrong though. That'd be very cool.

Re: Researchers crack the world’s toughest encryption

#20

Post by JoeAltmaier »

exo762 wrote: post #13

There is a patch for that in GnuPG, available in both Debian and Ubuntu. Update your machines :) FLOSS is amazing. One day since research paper and your machines are already patched. This means that probably no one had enough time to actually use this attack vector in the wild.

I wonder how the patch was vetted. And what it costs- more CPU time? Slower decryption by what factor? Or does it just defeat the current technique, requiring new measurements to pin down THIS code's characteristic sounds.
Post reply on HN