Acoustic cryptanalysis is a type of side channel attack which exploits sounds emitted by computers or machines.

Modern acoustic cryptanalysis mostly focuses on the sounds produced by computer keyboards and internal computer components, but historically it has also been applied to impact printers and electromechanical cipher machines.

Known attacks

  • In 2004, Dmitri Asonov and Rakesh Agrawal of the IBM Almaden Research Center announced that computer keyboards and keypads used on telephones and automated teller machines (ATMs) are vulnerable to attacks based on the sounds produced by different keys. Their attack employed a neural network to recognize the key being pressed. By analyzing recorded sounds, they were able to recover the text of data being entered. These techniques allow an attacker using covert listening devices to obtain passwords, passphrases, personal identification numbers (PINs), and other information entered via keyboards. In 2005, a group of UC Berkeley researchers performed a number of practical experiments demonstrating the validity of this kind of threat. (link)

  • Also in 2004, Adi Shamir and Eran Tromer demonstrated that it may be possible to conduct timing attacks against a CPU performing cryptographic operations by analyzing variations in humming emissions. Analyzed emissions were ultrasonic noise emanating from capacitors and inductors on computer motherboards, not electromagnetic emissions or the human-audible humming of a cooling fan.(link)

  • Shamir and Tromer, along with new collaborator Daniel Genkin and others, then went on to successfully implement the attack on a laptop running a version of GnuPG (an RSA implementation), using either a mobile phone located close to the laptop, or a laboratory-grade microphone located up to 4 m away, and published their experimental results in December 2013. (link)

history | show excerpt | excerpt history