安全与密码学2020comp.nus.edu.sg
倾听你的钥匙：面向基于声学的物理钥匙推断
Listen to Your Key: Towards Acoustics-based Physical Key Inference
进阶 · 约 60 分钟读完前置知识：声学信号处理基础、机械锁原理、机器学习基础
导读
这篇论文（SpiKey）研究能否通过钥匙插入锁孔时发出的声音推断钥匙的齿形（bitting code）。作者通过模拟钥匙插入锁中的声音来反推钥匙形状，并声称可据此 3D 打印钥匙开门。
HN 关注点：这类“声学攻击”安全研究的真实可行性，讨论焦点是论文实验是否基于真实录音、以及实际攻击难度是否被夸大。
HN 评论精选
这几条评论里：质疑 2 补充 2
质疑论文实际用的是模拟声音而非真实录音，媒体报道夸大了研究
我有点怀疑，于是顺着链接读了原论文。他们并没有录下真实钥匙插入真实锁的声音再推断钥匙形状，而是模拟了钥匙在锁中发出的声音，再从模拟声音推断形状，且模拟假设钥匙以固定的 1 英寸/秒速度插入。所以这篇报道是失实的。报道者本不难读论文并如实描述，却选择夸大，这让我很困扰。（编辑：至少从论文第 4 节看，我没找到所谓“基于真实录音的模拟”中的真实录音。）
justinpombrio查看英文原文
I was a little skeptical, so I followed the link trail to the actual paper: https://www.comp.nus.edu.sg/~junhan/papers/SpiKey_HotMobile20_CamReady.pdf They did not take a recording of an actual key in an actual lock and determine the shape of the key. Instead they simulated the sound of a key in a lock, and determined the shape of the key from that simulated sound. And the simulation assumed that the speed that the key moves at is fixed as it enters the lock, at 1 inch per second. So this article is false. It wouldn't have been that hard to read the paper, and say what they actually did. It bothers me that articles like this don't, and instead run with an exaggeration. EDIT: As far as I can tell from the paper, at least. What on earth is a "simulation, based on real-world recordings"? I don't see anything about an actual recording in section 4.
质疑这类攻击实际难度远高于直接撬锁，标题党安全研究弊大于利
有没有人也厌倦了这些标题吓人但毫无现实影响的安全帖？就算真能靠声音复制钥匙，获得干净录音、回家做出新钥匙并成功开锁，也比直接拿两根金属签 15 秒撬开锁难上十万倍。这些帖子对我们是消遣，但会被不懂行的人转发，最后有人给门装隔音罩，或者宣称锁不安全。
Polylactic_acid查看英文原文
Is anyone else feeling feeling tired of these security posts that have scary titles but literally no real world impact? Ok, maybe you can copy a key from sound but getting a clean recording and then going home and producing a new key and getting it correct is 100000x harder than just sticking 2 metal sticks in the lock and opening it in 15 seconds. To us these posts might provide some light entertainment but then they get shared around by people who people who don't know better and next thing you know people are installing sound proof booths on the front of doors or telling us locks are insecure because they just found out about this trick.
补充该攻击无法应对带防撬弹子的锁，实际价值有限
这似乎只对最基础的锁有效，没有考虑“安全弹子”或假弹子（移动时会卡住锁芯），这些会导致假开、咔哒声、锁芯半转等干扰。即使是经验丰富的开锁匠也很难对付它们，而大多数中高级锁都有这类防撬措施。实际上直接开锁远比复制钥匙快。
Alupis查看英文原文
This seems to work on only the most basic of locks, and doesn't seem to address "Security Pins" or false pins (pins if you move, will seize the keyway), which will cause false sets, clicks, partial keyway turns, etc. They can be really nasty for an experienced lockpicker to navigate, and will make all the same sounds and feel of picking a real pin. Most semi-advanced locks will have one or more of these anti-picking countermeasures in place. As it is, it would be far faster to actually pick this lock instead of trying to reproduce the key.
补充复制钥匙根本不需要 3D 打印，手工锉制即可
论文说“我们可以 3D 打印推断出的齿形钥匙，其中一把就能开门”。其实你只要 2D 打印几张实际尺寸的钥匙图，我用锉刀 15 分钟就能在钥匙坯上锉出来。
kazinator查看英文原文
> we can 3D-print the keys for the inferred bitting codes, one of which will unlock the door,” says Ramesh. If you 2D-print me a piece of paper with a few copies of the key image in actual size, I will cut that shape into a blank in about 15 minutes with a file.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2020Hacker News 讨论帖349 分 · 121 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选