Side-channel attacks on post-quantum cryptography implementations

Short answer: A post-quantum algorithm can be mathematically sound and still leak secrets through the device that runs it, via power use, electromagnetic emissions or timing. A 2025 survey and a 2022 NIST conference paper both argue that these side-channel attacks need systematic study for post-quantum schemes. This is a research-stage topic, and the papers' findings are theirs, not ours.

Why do standardized PQC schemes remain vulnerable to physical attacks?

Standardized schemes such as CRYSTALS-Kyber, CRYSTALS-Dilithium (now ML-KEM and ML-DSA) and SPHINCS+ offer strong theoretical security, yet practical deployments remain susceptible to physical-layer vulnerabilities. The core issue is that while the algorithmic level guarantees security against quantum computers, real-world implementations often suffer from other vulnerabilities like side-channel attacks. These attacks exploit unintentional leakages in hardware and software implementations, including power traces, electromagnetic emissions, and timing variations. Because these leaks occur during the execution of cryptographic operations, they allow an adversary to recover secret keys without altering the target system. One 2025 survey calls them a critical threat vector for PQC in embedded and resource-constrained environments. The transition to PQC is accelerating due to the potential of quantum computing to compromise classical public-key cryptosystems, but this shift does not eliminate the need for robust implementation-level security. The papers treat the physical layer as a separate attack surface from the algorithm.

What specific side-channel attack vectors are most relevant to lattice-based PQC?

Researchers have identified several specific attack vectors that target the implementation details of lattice-based PQC algorithms. Timing attacks are noted as important to consider and are often addressed in implementations, but other classical side-channel attacks are considered real threats that require systematic study. These include Simple Power Analysis (SPA), Differential Power Analysis (DPA), Correlation Power Analysis, Electromagnetic Analysis, Template Attacks, and Fault Attacks. For lattice-based Key Encapsulation Mechanisms (KEM), power and electromagnetic attacks on decapsulation based on the Fast Orthogonal Transform (FO Transform) are a specific concern. In such cases, the entire decapsulation process may need to be masked to prevent leakage. Template attacks, which require detailed knowledge of the target, are also identified as a real threat, particularly in the context of key generation. Although template attacks demand more precise modeling of the device, the 2022 paper notes they have been investigated in security certifications such as Common Criteria and EMVco.

How do masking countermeasures address these implementation vulnerabilities?

Masking is a primary countermeasure strategy used to obscure intermediate values during cryptographic computations. Researchers have analyzed the efficiency and efficacy of existing countermeasures in current hardware implementations to identify those that provide broader protection. Two main types of masking are discussed: arithmetic masking and Boolean masking. A significant technical challenge arises when converting between these two forms, as different stages of an algorithm may naturally lend themselves to one type of masking over the other. Efficient classical mask conversions exist to bridge this gap, allowing implementations to maintain security across different operational phases. High-order masking is also noted as a countermeasure, particularly in the context of template attacks on key generation. The goal of these countermeasures is to ensure that the physical leakage does not correlate with the secret key material. The 2025 survey says this analysis helps identify characteristics needed for future secure implementations.

What gaps remain in the current research landscape for PQC security?

Despite the availability of standardized algorithms, significant gaps remain in the systematic study of side-channel vulnerabilities. Researchers have categorized attacks from an adversarial perspective to identify the most vulnerable components of PQC implementations and to highlight unexplored parts in current implementations. While resistance to timing attacks is commonly addressed, other powerful attacks are often left for further research. The challenge is to systematically study these threats rather than treating them as secondary concerns. Current efforts aim to provide guidance in strengthening existing systems and developing more efficient defenses. The survey says its aim is to identify countermeasures that provide broader protection. Nothing here describes a particular product or deployment.

FAQ

What is a side-channel attack?

An attack that uses unintentional leakage from an implementation, such as power traces, electromagnetic emissions or timing, to recover secret keys without altering the target.

If the algorithm is secure, why does this matter?

A 2025 systematization paper says security is guaranteed at the algorithmic level, but real-world implementations often suffer from other vulnerabilities such as side-channel attacks.

Which attacks do the papers list?

Timing attacks, Simple Power Analysis, Differential and Correlation Power Analysis, Electromagnetic Analysis, Template Attacks and Fault Attacks.

What is masking?

A countermeasure that hides intermediate values during computation. The 2022 paper discusses arithmetic and Boolean masking, notes the need to convert between them, and says efficient conversions exist.

Is this solved?

The papers describe it as an area needing more study. One says resistance to timing attacks is usually addressed while other attacks are mainly left for research.