Filtering out a signal that's in the same band is notoriously difficult.
If the signal you're subtracting is known to you, you can simply lock the phases and subtract. That's pretty trivial.
But knowing the name of the song doesn't necessarily give you a known signal to subtract. Conceivably, you could be working with a version of the song that was compressed differently than the one playing on the target computer. In which case, the two signals might not have the same waveform, and they wouldn't cancel.
To the listener's ear, the signals may sound identical. A good example of this principle is musical instruments. Have a skilled violinist play the same note twice with the same articulation for the same duration under the same conditions. Record each sample the same way. Most listeners would say these two samples are identical. But if you invert one and then mix them, they won't cancel, because they didn't actually have the same waveform.
But it's definitely an interesting approach, and potentially viable, if a good filtering algorithm can be worked out. My suspicion is that such an algorithm exists or is at least possible. But I'm not an audio engineer, so I'm not certain.
I suspect that, in practice, playing music will provide enough of a barrier to mitigate attacks using these side-channels. But then again, in practice, I'd hope that attacks using these side-channels are pretty infrequent to begin with.
Besides, in practice, upgrading to GnuPG 1.4.16 (released today) is supposed to also mitigate the key extraction attack using this side channel.
The naive approach I suggested would be easily defeated by playing two songs from two different sources; which itself would be defeated by setting up soundcloud on two devices in both places and carefully setting up/analyzing/modelling the room so that you can adjust the signal you're subtracting to account for the distance the sound waves travel and whatnot. I think after a while you just get increasing complexity and diminishing returns -- i.e. it becomes an arms race.
Certainly you also can't assume that a recording of a sound played via crappy laptop speakers will even closely resemble the original waveform. Playing back (distortion by differing air pressure etc) and recording (environment & A/D noise anyone?) will completely distort it.
Comments
Filtering out a signal that's in the same band is notoriously difficult.
If the signal you're subtracting is known to you, you can simply lock the phases and subtract. That's pretty trivial.
But knowing the name of the song doesn't necessarily give you a known signal to subtract. Conceivably, you could be working with a version of the song that was compressed differently than the one playing on the target computer. In which case, the two signals might not have the same waveform, and they wouldn't cancel.
To the listener's ear, the signals may sound identical. A good example of this principle is musical instruments. Have a skilled violinist play the same note twice with the same articulation for the same duration under the same conditions. Record each sample the same way. Most listeners would say these two samples are identical. But if you invert one and then mix them, they won't cancel, because they didn't actually have the same waveform.
But it's definitely an interesting approach, and potentially viable, if a good filtering algorithm can be worked out. My suspicion is that such an algorithm exists or is at least possible. But I'm not an audio engineer, so I'm not certain.
I suspect that, in practice, playing music will provide enough of a barrier to mitigate attacks using these side-channels. But then again, in practice, I'd hope that attacks using these side-channels are pretty infrequent to begin with.
Besides, in practice, upgrading to GnuPG 1.4.16 (released today) is supposed to also mitigate the key extraction attack using this side channel.
The naive approach I suggested would be easily defeated by playing two songs from two different sources; which itself would be defeated by setting up soundcloud on two devices in both places and carefully setting up/analyzing/modelling the room so that you can adjust the signal you're subtracting to account for the distance the sound waves travel and whatnot. I think after a while you just get increasing complexity and diminishing returns -- i.e. it becomes an arms race.
Certainly you also can't assume that a recording of a sound played via crappy laptop speakers will even closely resemble the original waveform. Playing back (distortion by differing air pressure etc) and recording (environment & A/D noise anyone?) will completely distort it.