Security & Privacy
Is it safe to send private keys via audio? Can someone intercept them?
This is an excellent question that addresses critical security concerns:
Interception Risk
Real Risk: Yes, any device with a microphone nearby can record the audio transmission.
Protection: SonarLink uses automatic AES-256 encryption - even if intercepted, the audio contains encrypted data that cannot be read without the password.
Important: If you use a weak password AND someone intercepts the transmission, they could potentially brute-force it offline.
Recommendations for Private Keys:
- Controlled Environment: Private room without untrusted devices, disable Alexa/Google Home, close doors and windows
- Strong Password: Minimum 16 characters with mixed case, numbers, and symbols
- Double Encryption: Encrypt the key file before using SonarLink for critical keys
- Verify HMAC: Always ensure HMAC verification passes 100%
When NOT to Use Audio Mode:
- ❌ Public environments (airports, cafés)
- ❌ Unencrypted master keys
- ❌ Cryptocurrency wallet seeds
- ❌ Root CA certificates
Safer Alternatives for Critical Keys: QR Code mode (screen-to-screen, harder to intercept), USB with encryption, or split secrets (divide into 3 parts, send separately).
Can I use QR codes for faster transfer?
SonarLink v1.0 does not include QR code functionality. However, you can use external tools for visual transmission:
Using QR Codes with External Tools
You can combine SonarLink with external QR code tools for faster, more reliable transfers:
- Encrypt your file using SonarLink (option 2 in menu, then save without transmitting)
- Generate QR code using external tools (qrencode, online generators, etc.)
- Scan QR code on receiving device using any QR scanner
- Decrypt the file using SonarLink (option 4 in menu)
| Method |
Speed (20KB) |
Reliability |
Requirements |
| SonarLink Audio |
~2.5 minutes |
~39% (environmental) |
Microphone + Speakers |
| External QR Tools |
~15 seconds |
100% |
Camera + QR software |
Advantages of Audio (SonarLink built-in):
- ✅ Covert transmission - harder to detect
- ✅ Works through walls/barriers
- ✅ No line-of-sight required
- ✅ All-in-one tool (encryption + transmission)
Advantages of QR codes (external tools):
- ✅ 10-40x faster transmission
- ✅ 100% reliability
- ✅ Works in noisy environments
- ✅ Can save QR image for later use
Note on File Transfer via QR Codes: QR codes can hold only up to ~3 KB of data, and under 1 KB is recommended for reliable scanning.
They work well for small, offline (air-gapped) transfers, such as keys or short text files.
For larger files, include an external link in the QR code, which can be used to download the file.
Recommended approach: Use SonarLink audio for small files (<50KB) or when cameras aren't available. For larger files or when speed matters, encrypt with SonarLink and transfer via external tools.
Can I use SonarLink in a corporate environment?
Yes, with proper procedures. SonarLink's encryption is secure, but corporate use requires additional considerations:
Suitable Corporate Use Cases:
- ✅ SSH keys between air-gapped systems
- ✅ Configuration files (with strong passwords)
- ✅ Code snippets between development systems
- ✅ Emergency credential transfers (controlled environment)
Requires Extra Precaution:
- ⚠️ Financial data
- ⚠️ Customer data
- ⚠️ Trade secrets
- ⚠️ Intellectual property
Use in isolated, monitored, logged environments
Corporate Best Practices:
- Document all transfers with audit trails
- Use in physically secure locations only
- Enforce strong password policies (16+ characters)
- Implement verification procedures
- Consider compliance requirements (GDPR, HIPAA, etc.)
For ultra-sensitive data: Consider dedicated enterprise file transfer systems with full audit capabilities.
Transmission Methods
What are the limitations of acoustic transmission?
Acoustic transmission has inherent physical limitations:
Current Limitations:
- Speed: ~2.5 minutes for 20KB file (significantly slower than network)
- Reliability: ~39% success rate, heavily dependent on environment
- Distance: Optimal range <1 meter, maximum ~3 meters
- Environment: Requires quiet space for best results
- File Size: Practical limit ~100KB (larger files take too long)
When Acoustic Transfer Makes Sense:
- ✅ No network available or desired
- ✅ Air-gapped systems that cannot connect
- ✅ Small files (<50KB)
- ✅ Security priority over speed
- ✅ Covert operations where visual transfer is risky
Alternative Methods for Larger Files:
- Network transfer: When speed is critical and security permits
- USB drives: For larger files in air-gapped environments
- External QR tools: 10-40x faster for visual transmission
Bottom line: Acoustic transmission is a specialized tool for specific use cases, not a general-purpose file transfer solution.
Can I send audio via phone call or save it for later?
Phone Calls: ❌ NOT recommended
- Telephone codecs compress audio aggressively
- Frequencies are cut (typically 300-3400 Hz)
- Variable latency and packet loss
- Quality insufficient for reliable decoding
Better Alternative: Send as voice message (WhatsApp, Telegram, Signal) - these send as audio files without real-time compression.
Saving Audio for Later Use
✅ This works, but with current v1.0 limitations:
- You can't verify file integrity until playback
- Record from two positions for redundancy
- Test immediately before traveling with the recording
When should I use acoustic transfer vs other methods?
| Your Situation |
Best Method |
Why |
| 🏢 Office, need speed |
Network/USB |
Much faster for routine work |
| 🔒 Air-gapped systems |
SonarLink Audio |
No physical media needed |
| ✈️ No network available |
SonarLink Audio |
Works offline anywhere |
| 🎙️ Under surveillance |
SonarLink Audio |
Covert, no visual trace |
| 💻 Small config files |
SonarLink Audio |
Perfect for <20KB files |
| 📦 Large files (>100KB) |
USB/Network |
Audio too slow |
| 🛂 Border crossing |
SonarLink Audio |
Nothing to confiscate |
| 📱 Quick document share |
Network/Email |
Convenience over security |
Key principle: Use SonarLink when security, offline capability, or air-gap compliance outweigh the need for speed.
Reliability & Data Integrity
What if I lose packets during transmission? Will my private key be corrupted?
Yes, this is a real risk with audio transmission. A corrupted private key is completely unusable.
The Problem:
- One lost chunk out of 10 = file corrupted
- HMAC verification fails → file saved as .corrupted
- RSA key corruption = key becomes unusable
Current Protections in v1.0:
- ✅ HMAC verification detects corruption immediately
- ✅ Gzip decompression check fails if data incomplete
- ✅ Files are saved as .corrupted so you know something failed
- ❌ NO automatic retry - must retransmit manually
Solutions & Best Practices:
1. Test Immediately:
- Transmit the key
- Verify it immediately (try to use it)
- If it works, you know it's valid
- If it fails, retransmit while conditions are still good
2. Optimal Environment:
- Silent room with minimal background noise
- Devices very close (<1 meter)
- Volume at 60-80%
- Quality speakers and microphones
3. Multiple Backups:
- Transmit 2-3 times
- Save all versions
- Use the first one that verifies successfully
Why is the audio success rate only 39%?
The 39% success rate in v1.0 is affected by several environmental and protocol factors:
Main Factors:
- Environmental Noise: Background sounds interfere with acoustic transmission
- Distance: Success rate drops significantly beyond 1 meter
- Audio Hardware: Poor microphone/speaker quality affects decoding
- Reflections: Echo and room acoustics cause interference
- Volume Settings: Too low or too high reduces reliability
- Battery/Power: Devices throttling performance can affect transmission
How to Improve Success Rate:
- ✅ Use in completely silent room
- ✅ Place devices <30cm apart
- ✅ Use 60-70% system volume
- ✅ Disable other audio applications
- ✅ Use external speakers if possible
- ✅ Ensure full battery on both devices
Use Cases & Scenarios
What are the best use cases for SonarLink?
Excellent Use Cases:
🔐 Air-Gapped System Administration
Transfer SSH keys, configuration files, and credentials to isolated systems without physical media or network connections.
💻 Secure Development
Share API keys, deployment secrets, and code snippets between environments without using insecure channels.
🎙️ Journalism & Activism
Exchange sensitive information in hostile environments with covert audio transmission and plausible deniability.
🏢 Enterprise Deployment
Deploy configurations to multiple isolated systems quickly using QR codes without compromising security perimeters.
🔬 Research Labs
Transfer data between secure research systems without external network connectivity.
🛡️ Penetration Testing
Move tools and payloads between test systems without creating network traces.
Can I use this for transferring large files like videos?
Technically yes, but not recommended in v1.0.
| File Size |
Audio Time |
Recommendation |
| < 20 KB |
< 2.5 min |
✅ Good |
| 20-50 KB |
2.5-6 min |
⚠️ Okay |
| 50-100 KB |
6-12 min |
🔴 Slow |
| > 500 KB |
> 57 min |
❌ Avoid |
For Large Files:
- Use traditional encrypted USB drives or secure network transfer for files >100KB
- Audio mode becomes impractical beyond 50KB due to time and error probability
- Consider splitting files manually if acoustic transfer is required
Troubleshooting
My transmission keeps failing. How can I improve reliability?
Immediate Fixes:
□ Environment: Move to completely silent room, close doors/windows
□ Distance: Place devices within 30cm of each other
□ Volume: Set both devices to 60-70% volume
□ Audio Apps: Close all other audio applications (music players, voice calls)
□ Hardware: Use external speakers/microphone if available
□ Battery: Ensure both devices are fully charged or plugged in
□ File Size: Try smaller files first to test setup
I received a .corrupted file. What does this mean?
A .corrupted file indicates that the transmission was incomplete or tampered with.
What Happened:
- One or more audio chunks were lost or corrupted during transmission
- HMAC verification failed, indicating data integrity issues
- The file was saved with .corrupted extension to alert you
What To Do:
- Don't use the corrupted file - it may be incomplete or tampered
- Improve transmission conditions:
- Move to quieter environment
- Reduce distance between devices
- Adjust volume settings
- Retry the transmission with better conditions
- Consider QR mode if audio continues to fail
Security Note: Never try to "fix" or use a corrupted file, especially for cryptographic keys or sensitive data. Always retransmit to get a verified copy.
Can I verify a file before using it?
Yes! SonarLink automatically verifies every transmission using HMAC-SHA256.
Automatic Verification:
- Every received file is checked with HMAC-SHA256
- If verification passes → file is saved with original name and is safe to use
- If verification fails → file is saved as .corrupted and should not be used
Manual Verification (for critical files):
- After transmission completes successfully
- Immediately test the file (e.g., try to use an SSH key)
- If it works, you have confirmed the transfer was successful
- If it doesn't work, retransmit immediately
Best Practice: For critical transfers (private keys, certificates), always perform a functional test immediately after receiving the file.