RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis

I've just learned that this was already reported:

previous link

Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer, and in particular leak sensitive information about security-related computations. In a preliminary presentation, we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was that the acoustic side channel has a very low bandwidth (under 20 kHz using common microphones, and a few hundred kHz using ultrasound microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers.

RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis

Note: these are recent results, first published on 18 December 2013. Preliminary results were announced in the Eurocrypt 2004 rump session presentation titled "Acoustic cryptanalysis: on nosy people and noisy machines", and are now archived. The progress since the preliminary results is summarized in Q16 below.

I thought this maybe highly relevant for all the GnuPG ATS users.

The most relevant part:

The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts.

Meaning that an attacker can hear your secret key.

also:

Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.

There is already an Ubuntu Security Notice dealing with this, namely USN-2059-1

There's a thread here about it: www.abovetopsecret.com...

It's very interesting but according to the paper GnuPG has already been patched for version 2.x so the hole is plugged. For now.