Like people always say: “Attacks only get worse…” — which is why I'm asking early.
I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, 2013 by Daniel Genkin, Adi Shamir, Eran Tromer.
In short, they discovered that it is possible to crack 4096-bit RSA encryption keys using a microphone to listen to high-pitch noises generated by internal computer components. In one of their setups, they only used a mobile phone which was placed 30 cm from a target laptop, with the phone's internal microphone pointing towards the laptop’s fan vents… successfully achieving a full key extraction in this conﬁguration and distance.
The proof in that 57-page paper is hard enough to start thinking about related crypto-solutions. Especially since the paper mentions that rather simple hardware like parabolic microphones and laser vibrometers can be used for distant acquisition.
Now, I know this audio-based key recovery attack is a new one (published December 18, duh) but there has been quite some research on hardware-related attacks in the past already — like measuring the electrical potential of a computer's chassis during encryption etc. — and beyond that, the crypto-community tends to search for a solution to every problem encountered. So, I can imagine that there might be something out there I'm not aware of, which might be fit enough to lift one or more security impacts of acoustic cryptanalysis; especially in the described case(s) of acoustic key recovery attacks.
Can we ensure the security of a crypto-algorithm and/or -scheme against acoustic cryptanalysis? Does any generally acknowledged crypto-scheme, crypto-solution, or crypto-protocol exist which would be able to provide cryptographic security/defense against the described and maybe even other acoustic cryptanalysis of (non-RSA) ciphers?
I'm thinking along the lines of algorithm-tuning (somewhat like key whitening, which was once invented and implemented in iterated block ciphers to enhance security).
Related to solutions, the paper's website mentions
but also notes
How vulnerable are other algorithms and cryptographic implementations?
We don't know. Our attack requires careful cryptographic analysis of the implementation, which so far has been conducted only for the GnuPG 1.x implementation of RSA.
which practically means that chances are, there is no general, one-fits-all solution to the problem. Especially not when thinking about non-RSA ciphers.
Yet, if there is something… can that be used or adapted to successfully protect against all acoustic cryptanalysis, even beyond the vulnerabilities the paper describes? What cryptographic measures enable us to ensure the security of a crypto-algorithm and/or -scheme against acoustic cryptanalysis?