Schneier on Security

Clive Robinson • May 29, 2011 5:50 AM

OFF Topic,

@ Bruce,

This might be of interrest.

Four researchers from University of North Carolina at Chape Hill (Andrew White, Austin Matthews, Kevin Snow, and Fabian Monrose) presented a paper at the IEEE Symposium on Security and Privacy in Oakland California this week.

Titled “Hookt on fon-iks” it shows the development of their work of “Phonotactic Reconstruction of Encrypted VoIP Conversations”

Put simply the CELP speach compression algorithm originaly developed by the NSA and used in by far the majority of Voice to Data systems such as mobile phones and Skype will in some modes and usages leak sufficient information to allow recovery of the spoken words without having to “crack the encryption”

This current paper ( http://cs.unc.edu/%7Efabian/papers/vizsec10.pdf ) builds on earlier work ( http://www.cs.unc.edu/%7Efabian/papers/oakland08.pdf ).

It arives just in time to upset a few people because one target for their work is Skype, which does suffer from this problem. Not that this is the first time Skype has been hit, the previous paper caused Privacy International to request Skype to make changes (which it appears either they have not or not in the right way).

The problem is “efficiency” opening up a “side channel”, whereby the secrets leak out without the encryption realy doing much to stop it.

The “efficiency” in question is “variable bit rate encoding” which alows information on the phonems to escape to be used in reconstruction of words and sentences, thus conversations.

The difference between the earlier paper and the current one?

Well many incorectly dismised it as being a “theoretical” not a “practical” attack. The second paper shows that it is now practical and is at the point of being an “engineering” problem prior to tools apear on the Internet to do it.

As Bruce has often noted “attacks only get better”, and as I’ve often noted “it’s Efficiency -v- Security” if you don’t know what you are doing, and it’s not just Skype in the frame on this one…