News for hackers. Stuff that matters.

A comment on Voice Calls: Secure, Crystal-Clear, AI-Powered. Parent comment

Re:Voice Calls: Secure, Crystal-Clear, AI-Powered by drakenot on Thursday March 30, 2017 @10:31AM (#13995635)
Whoa, I had never thought of monitoring VBR as an attack vector for recovering audio.

Do you have a link discussing this?

[ Parent | on HN ]
Re:Voice Calls: Secure, Crystal-Clear, AI-Powered by JshWright on Thursday March 30, 2017 @10:37AM (#13995689)
Sure, here are a couple papers on the topic:

https://www.cs.jhu.edu/~cwright/oakland08.pdf

https://www.cs.jhu.edu/~cwright/voip-vbr.pdf

It's fundamentally very similar to the sorts of issues you end up with if you compress then encrypt. If the attacker can make some educated guesses about the plaintext prior to the compression, the compression ratio can be a very powerful tool in their arsenal.

[ Parent | on HN ]
Re:Voice Calls: Secure, Crystal-Clear, AI-Powered by walterbell on Thursday March 30, 2017 @01:37PM (#13997318)
Wire implemented CBR for their encrypted calls, upstreamed it to WebRTC and submitted a patch to Signal, https://medium.com/wire-news/call-security-constant-bit-rate...
[ Parent | on HN ]
Re:Voice Calls: Secure, Crystal-Clear, AI-Powered by JshWright on Thursday March 30, 2017 @04:36PM (#13998645)
Silent Phone has used CBR since day 1.
[ Parent | on HN ]