SoK: Keylogging Side Channels

### Overview In this Systematization of Knowledge (SoK) presentation, Vinny Monaco examines keylogging side-channel attacks across physical keyboards, host systems, and network environments. A keystroke comprises the complete action of pressing and releasing a key, involving actuation and de-actuation events mediated by user physiology, keyboard matrix scanning, host interrupt handling, process scheduling, and network transmissions. Monaco frames keylogging through two distinct tasks: keystroke detection (a binary classification problem to confirm a keystroke within a time window) and key identification (a multi-class classification problem to determine the specific key pressed).

### Key Topics - **Historical Precedents**: The evolution of keystroke side channels spanning roughly 75 years, beginning with the Bell Labs discovery of electromagnetic emanations from teletype terminals (the origin of TEMPEST, later expanding to acoustic and seismic modalities). A notable real-world hardware attack occurred via Soviet bugs implanted into IBM Selectric typewriters at the U.S. Embassy in Moscow, which sensed internal lever movements and transmitted data via radio bursts for eight years until discovered, prompting the U.S. mitigation effort known as Project Gunman. - **Modern Attack Modalities**: Modern vectors exploit diverse physical and logical channels. These include measuring user behavior (video line-of-sight, smartwatch accelerometers, Wi-Fi signal distortion), keyboard emanations (acoustics, seismic vibrations, radio emanations, parasitic capacitance across power lines from unencrypted USB/PS/2 cables), host metrics (CPU load, cache usage, the proc file system), and network traffic timing (upstream packet latency or downstream server responses in web applications).

### Technical Details Monaco highlights a taxonomy classifying attacks along five dimensions, focusing closely on how leaked information enables key reconstruction: - **Spatial Side Channels**: - *First-Order Spatial Channels*: Directly reveal keyboard coordinates or physical locations (e.g., using multi-microphone arrays to localize the sound source via time-difference-of-arrival techniques). - *Second-Order Spatial Channels*: Leak relative distances between keystrokes (e.g., single-microphone acoustic profiling exploiting a keyboard 'drum effect,' where adjacent keys produce similar acoustic waveforms). While second-order channels yield isomorphic keystroke sequences, the constraints of natural languages like English rapidly reduce isomorphisms as sequence length grows, approaching the information gain of first-order channels. - **Temporal Side Channels**: Depend exclusively on keystroke timing (press latency and release timing). This is feasible because inter-keystroke timing exhibits an inverse scaling relationship with physical inter-key distance (distant keys are pressed more rapidly because touch typists use alternate hands in parallel, whereas close keys require hand and finger repositioning). Furthermore, this relationship is consistent across different users. - **Behavioral Homogeneity vs. Biometric Menagerie**: Unlike hardware semiconductors where manufacturing homogeneity yields identical timing channels across identical CPUs, human typing features significant behavioral heterogeneity (touch typists vs. hunt-and-peck typists). Attack efficacy mirrors the biometric menagerie: vulnerable typists are 'lambs' yielding high information gain per latency, while resilient typists are 'goats' with low leak rates. Monaco connects this to the concept of Langlands program, proposing a unified framework to study the trade-offs between identifying a user's biometric identity and reconstructing the text of their actions.

### Takeaways Keylogging side channels have grown substantially due to ubiquitous sensing, signal processing, and machine learning. Monaco predicts that temporal keylogging attacks against client-server web applications will become significantly more effective as modern machine learning techniques are applied to upstream event timings. Addressing keyboard layouts (such as QWERTY vs. Dvorak or regional variants) and diverse mobile/soft keyboard input styles remain important considerations for future research.