4 ms·
Whoa, I had never thought of monitoring VBR as an attack vector for recovering audio. Do you have a link discussing this?
by drakenot 10y ago
Whoa, I had never thought of monitoring VBR as an attack vector for recovering audio.
Do you have a link discussing this?
- JshWright 10y agoSure, here are a couple papers on the topic: https://www.cs.jhu.edu/~cwright/oakland08.pdf https://www.cs.jhu.edu/~cwright/oakland08.pdf https://www.cs.jhu.edu/~cwright/voip-vbr.pdf https://www.cs.jhu.edu/~cwright/voip-vbr.pdf It's fundamentally very similar to the sorts of issues you end up with if you compress then encrypt. If the attacker can make some educated guesses about the plaintext prior to the compression, the compression ratio can be a very powerful tool in their arsenal.
- walterbell 10y agoWire implemented CBR for their encrypted calls, upstreamed it to WebRTC and submitted a patch to Signal, https://medium.com/wire-news/call-security-constant-bit-rate-encoding-and-improving-webrtc-a85be6caa43a https://medium.com/wire-news/call-security-constant-bit-rate...
- JshWright 10y agoSilent Phone has used CBR since day 1.