A cryptographic algorithm can be mathematically sound and still leak its secrets through the way it is implemented. The execution of any cryptographic operation produces signals beyond its inputs and outputs: power draw varies with the data being processed, the time taken depends on branch decisions, the electromagnetic emissions of the chip change as transistors switch, the cache state reveals which memory addresses were touched, the acoustic emanations of capacitors hint at the work the CPU is doing. These signals are side channels, and an attacker who can observe them can often recover keys or plaintext that the algorithm was supposed to protect.
Side-channel attacks are not new. Paul Kocher's 1996 paper "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems" introduced the field to the public cryptographic community, and the Differential Power Analysis paper by Kocher, Jaffe, and Jun in 1999 showed how trivial measurements of a smart card's power consumption could extract DES keys.
The post-quantum algorithms standardised by NIST in August 2024 are not immune. ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) all have implementation pitfalls that have been demonstrated to leak through power, timing, electromagnetic, and cache side channels. The IACR ePrint archive contains hundreds of papers from 2018 to 2026 demonstrating concrete attacks on lattice-based and hash-based schemes, and the lessons from a quarter-century of side-channel research apply directly to the new standards.
This article walks through the specific side-channel attack surface of post-quantum algorithms, the most consequential published attacks, the countermeasures, and what organisations deploying PQ should require of their implementations.
The Side-Channel Threat Model
Side-channel attacks vary in adversary capability. The two main categories are:
Local physical access. The attacker has the device in hand, can attach probes, can measure power and electromagnetic emissions directly, and can submit chosen inputs. This is the smart-card and HSM threat model. Attacks include simple power analysis (SPA), differential power analysis (DPA), correlation power analysis (CPA), template attacks, and electromagnetic analysis (EMA).
Remote or co-located. The attacker shares hardware (cloud co-tenancy), runs code on the same machine, or sends network requests. Attacks include cache-timing attacks (Flush+Reload, Prime+Probe), branch-prediction attacks (Spectre-class), microarchitectural attacks, and remote timing attacks over the network.
For deployed PQ implementations, both threat models matter. HSMs and smart cards face the local physical threat. Cloud workloads, web servers, and shared infrastructure face the remote co-located threat.
ML-KEM Attack Surface
ML-KEM is a lattice-based key encapsulation mechanism. It uses module learning with errors over a polynomial ring. The decapsulation process performs polynomial multiplication, an inverse number-theoretic transform (NTT), and a comparison check between a re-encrypted message and the received ciphertext.
The most studied side-channel attack surfaces in ML-KEM are:
Polynomial multiplication and NTT. The NTT is performed on secret data. Naive implementations have memory access patterns and branch behaviour that depend on the secret. Cache-timing attacks have been demonstrated.
Decoding (rejection sampling and decompression). The decoder converts ciphertext back to a polynomial. Timing variations in the decoder leak information about coefficients.
Comparison check. The Fujisaki-Okamoto transform requires a constant-time equality check between ciphertexts. Implementations that use early-exit comparisons leak.
Several published attacks demonstrate practical key recovery against ML-KEM (and its predecessor Kyber). Notable examples:
Mujdei et al., "Side-Channel Analysis of Lattice-Based Post-Quantum Cryptography: Exploiting Polynomial Multiplication," IACR ePrint 2022/474. Shows polynomial multiplication leaks via DPA on a Cortex-M4 implementation.
Pessl, Primas et al., "More Practical Single-Trace Attacks on the Number Theoretic Transform," IACR ePrint 2018/1019. Single-trace attack on NTT implementations.
Ravi, Bhasin et al., "Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs," IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) 2020(3). Generic attacks targeting the Fujisaki-Okamoto transform.
Ueno et al., "Curse of Re-encryption: A Generic Power/EM Analysis on Post-Quantum KEMs," TCHES 2022(1). Power and EM attacks on the re-encryption step of CCA-secure KEMs.
Kannwischer, Pessl, Primas, "Single-trace attacks on Keccak," TCHES 2020(3). Attacks on the SHA-3/Keccak instances used inside ML-KEM.
These are not theoretical. Several authors demonstrated working attacks on commodity microcontrollers (typically STM32 with Cortex-M4 cores) extracting full secret keys with measured oscilloscope traces.
ML-DSA Attack Surface
ML-DSA is a lattice-based digital signature scheme based on Fiat-Shamir with aborts. The signing operation produces a candidate signature, checks whether it satisfies the rejection criteria, and re-tries until it does. This rejection sampling step is particularly side-channel-sensitive.
The most studied attack surfaces:
Rejection sampling. The number of iterations required to produce a valid signature depends on secret data. Timing attacks observing iteration counts have been demonstrated.
Polynomial operations. As with ML-KEM, polynomial multiplication and NTT operations on secret data leak via power, EM, and cache.
Hint generation. The signing process produces a "hint" that helps verification. Hint generation can leak about the secret.
Notable published attacks:
Ravi, Bhasin et al., "Exploiting Determinism in Lattice-based Signatures: Practical Fault Attacks on pqm4 Implementations of NIST Candidates," ACM AsiaCCS 2019. Fault attacks on Dilithium (ML-DSA) implementations.
Bhasin et al., "Attacking and Defending Masked Polynomial Comparison for Lattice-based Cryptography," TCHES 2021(3). Power analysis of comparison routines in Dilithium.
Sim, Han et al., "Single-trace attacks on the message encoding of lattice-based KEMs," IACR ePrint 2020/992. Generalises to signature schemes.
SLH-DSA Attack Surface
SLH-DSA is a hash-based signature scheme. It is structurally different from ML-KEM and ML-DSA: there are no lattice operations, only repeated hashing. This is widely viewed as a side-channel advantage. Hashing operations are relatively constant-time when implemented carefully, and the security analysis is conservative.
However, SLH-DSA is not side-channel-free:
Internal counter and tree state. SLH-DSA operates on a hypertree structure. The path through the tree depends on the message. Cache and timing attacks on tree traversal are conceivable.
Hash function implementation. The underlying hash (SHA-256, SHA-3, or SHAKE) must be constant-time. Most modern implementations are, but legacy implementations can be vulnerable.
Random number generation. SLH-DSA in its randomised mode requires fresh randomness. RNG side channels (predictability or leakage) can compromise signatures.
The published side-channel literature on SLH-DSA is thinner than for ML-KEM and ML-DSA, both because the scheme is newer and because the attack surface is genuinely smaller. But "less attack surface" is not "no attack surface."
Power Analysis Attacks in Detail
Power analysis attacks exploit the fact that CMOS transistors consume power proportional to switching activity. When a CPU multiplies a 32-bit integer by a secret coefficient, the power signature reflects the bit pattern of the coefficient.
Simple Power Analysis (SPA) reads the power trace directly. If the cryptographic operation has visible structure that depends on the key (a square-and-multiply RSA, for example), SPA can sometimes extract the key from a single trace. PQ algorithms have less obvious key-dependent structure than RSA, but SPA against early ML-KEM implementations has been demonstrated.
Differential Power Analysis (DPA) collects many traces and statistically separates them based on a hypothesis about a small key fragment. By repeating across all key fragments, the full key is recovered.
Correlation Power Analysis (CPA) is a refinement of DPA that uses Pearson correlation between predicted intermediate values and measured power.
For post-quantum implementations, the countermeasure is masking: secret values are split into shares, and operations are performed on shares such that no single share contains the secret. Masking comes in orders: first-order masking protects against attacks that combine information from a single point, second-order masking protects against attacks that combine information from two points, and so on.
Higher-order masking is expensive. For lattice-based schemes, masked implementations can be 5-10x slower than unmasked. This is a real engineering trade-off.
Timing Attacks in Detail
Timing attacks exploit variability in execution time. If a function takes 1.0 microseconds when one bit is set and 1.5 microseconds when another bit is set, an attacker timing many requests can recover bits.
For lattice-based schemes, the most common timing pitfalls are:
Rejection sampling. The number of iterations before acceptance leaks.
Branch instructions on secret data. Conditional jumps cause pipeline behaviour that varies.
Memory accesses dependent on secret data. Cache hits and misses produce timing variations.
Polynomial reduction. Modular reduction with conditional subtraction can leak.
The defence is constant-time implementation: every code path executes in time independent of secret data. This is harder than it sounds. A naive constant-time check is to always perform the conditional operation but use bitmask tricks to make the result depend on the condition. Compilers can defeat this by recognising the redundancy. Real constant-time code requires careful inspection of the compiled output.
Cache Attacks
Cache attacks exploit the difference in access time between cache hits and misses. If a victim's secret-dependent access pattern can be observed via cache state, the attacker can recover secrets.
Two main cache attack techniques:
Flush+Reload. The attacker flushes a cache line, waits for the victim to execute, then reloads the cache line and times the access. A short access time indicates the victim accessed the line.
Prime+Probe. The attacker fills the cache with their own data ("primes"), waits for the victim, then accesses each cache line and times each access ("probes"). Slow accesses indicate the victim evicted those lines.
Both techniques work across cores on modern CPUs. They have been demonstrated against PQ implementations, particularly against table-based polynomial multiplication and against secret-dependent NTT memory access patterns.
The defence is cache-oblivious or cache-constant implementation: code that accesses the same memory regardless of secret values. This often means avoiding lookup tables or using bit-slicing techniques that perform parallel computation on bit-level slices of the data.
Fault Injection
Fault injection actively perturbs the device to induce computational errors. Voltage glitching, clock glitching, electromagnetic injection, and laser injection are all standard techniques.
Against PQ algorithms, fault attacks have been demonstrated to:
- skip the rejection check in ML-DSA, producing a forged signature;
- corrupt one polynomial coefficient in ML-KEM decapsulation, leading to a recovered partial secret;
- skip an iteration in ML-DSA signing, producing biased signatures whose distribution leaks the key.
Countermeasures include verification of intermediate results, redundant computation, and physical hardening of the device.
What Organisations Should Require
For post-quantum cryptography deployments, the side-channel question is unavoidable. Organisations should require:
Constant-time implementations. Vendor must demonstrate constant-time properties through tools like ctgrind, dudect, or formal verification.
Masking for high-assurance environments. For HSM deployments, smart cards, and high-value targets, masked implementations are appropriate.
FIPS 140-3 validation. NIST's CMVP programme validates cryptographic modules. FIPS 140-3 Levels 3 and 4 require physical tamper resistance and side-channel resistance. As of 2026, validated PQ modules are emerging from the major HSM vendors.
Public source code. Open implementations can be inspected for side-channel issues. Proprietary implementations often hide problems.
Independent third-party assessment. SOG-IS Common Criteria assessments and lab evaluations should explicitly cover side-channel resistance.
Update path. Side-channel research moves fast. Organisations should be able to update implementations as new attacks and countermeasures emerge.
For more on hybrid deployment, see Hybrid Encryption. For ML-KEM specifically, see ML-KEM Explained.
FAQ
Are post-quantum algorithms more vulnerable to side-channel attacks than RSA or ECDSA? Not inherently. The mathematical structure differs, but the implementation pitfalls are similar. Lattice schemes have rejection sampling and polynomial multiplication as new vulnerable operations; RSA had modular exponentiation and ECDSA had scalar multiplication. The maturity of countermeasures for classical schemes is greater simply because they have been studied longer.
Are SLH-DSA implementations safer than ML-KEM/ML-DSA? Generally yes. The hash-based structure has less side-channel attack surface. But SLH-DSA signatures are larger and slower, which is the trade-off.
Is FIPS 140-3 validation enough? FIPS 140-3 covers a defined set of side-channel concerns at higher levels (Level 3 and 4 cover physical tamper response, Level 4 includes EFP/EFT requirements). It is a strong baseline but does not exhaust the side-channel attack surface, particularly against advanced adversaries.
Can software-only countermeasures defeat power analysis? Software masking and bit-slicing can defeat first-order DPA on commodity processors. Higher-order attacks and EM attacks may require hardware countermeasures (shielding, sensor-based glitch detection).
How do I evaluate a PQ implementation's side-channel resistance? Start with ctgrind or dudect (open-source tools for constant-time analysis). Review the source code for branch instructions and memory accesses on secret data. Engage an independent lab for rigorous evaluation if the deployment is high-value.
Sources
- Kocher, "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems," CRYPTO 1996, https://www.paulkocher.com/doc/TimingAttacks.pdf
- Mujdei et al., "Side-Channel Analysis of Lattice-Based Post-Quantum Cryptography," IACR ePrint 2022/474, https://eprint.iacr.org/2022/474
- Ravi et al., "Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs," TCHES 2020(3), https://tches.iacr.org/index.php/TCHES/article/view/8593
- Pessl, Primas et al., "More Practical Single-Trace Attacks on the Number Theoretic Transform," IACR ePrint 2018/1019, https://eprint.iacr.org/2018/1019
- Ueno et al., "Curse of Re-encryption: A Generic Power/EM Analysis on Post-Quantum KEMs," TCHES 2022(1), https://tches.iacr.org/index.php/TCHES/article/view/9292
- NIST FIPS 203, FIPS 204, FIPS 205 (August 2024), https://csrc.nist.gov/projects/post-quantum-cryptography
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.