The scheme, published in Mobile Networks and Applications, is called a randomness-resilient one-pass authenticated key-establishment protocol. The phrase one-pass is the crucial part. In a one-pass protocol, the sender transmits a single message and the receiver can immediately derive a shared secret key from it. No round trips, no back-and-forth handshake, no waiting for a distant certificate server to respond. For vessels crossing oceans on intermittent high-frequency and satellite channels, where every extra message costs time and precious spectrum, cutting the exchange to a single transmission is not a luxury—it is often the difference between a secure session and no session at all.

One-pass designs carry a well-known structural risk. Because the sender produces the key-encapsulation material alone, the security of the entire session hinges on the quality of the random numbers the sender’s device generates. Cryptographers have documented this weakness repeatedly in the real world. Studies of network devices have found widespread weak keys traceable to poor random number generation, and virtual machine reset vulnerabilities have caused systems to reuse randomness that should never repeat. If a shipboard embedded computer, starved of entropy during a cold boot at sea, produces predictable randomness, an attacker who guesses or reconstructs that randomness can recover the session key and read everything the vessel transmits.

The Shanghai team’s answer is to make the protocol resilient to exactly this failure mode. Instead of trusting the sender’s random source blindly, the scheme derives the key-encapsulation mechanism randomness from both the sender-side random source and the session context—the specific identities and parameters of the exchange in progress. This hedging approach follows a line of research that began with hedged public-key encryption, where the ciphertext is bound to the message and the public key so that even repeated or partially predictable randomness does not produce catastrophic key reuse. In the maritime setting, the session context acts as a second, deterministic input that an attacker cannot freely choose, blunting the damage that a weak onboard random number generator can do.

The second half of the problem is cross-domain authentication. When a receiver gets a message from a vessel it has never dealt with, it must confirm two things: that the sender genuinely belongs to the administrative domain it claims, and that its certificate is valid. Traditional public-key infrastructures would have the receiver contact the sender’s home domain authority to check. The new scheme replaces that live lookup with commitments. A coordinator commits to the registered domain records, and each domain’s log commits to the certificate records it currently holds. These commitments, built on Merkle tree structures of the kind used in certificate transparency systems, allow the receiver to verify the sender’s domain and certificate locally, against commitments it has already accepted, without any network contact with the sender’s home authority during session establishment.

This is where the design connects to a broader movement in security engineering. Certificate transparency, accountable key infrastructures, and attack-resilient PKI designs all share the insight that verifiable, append-only logs can replace trust-on-each-connection queries to a central authority. Bringing that model to the open ocean is a natural but nontrivial step. Maritime communication standards have explored public key authentication for the Automatic Identification System and the VHF Data Exchange System, but cross-domain verification has remained expensive in bandwidth and latency. By pushing verification into committed logs that can be synchronized in advance, the new protocol makes the trust check essentially free at session time.

The security analysis is carried out in the random oracle model, a standard idealization in which hash functions are treated as truly random functions. Within that model, the authors prove three properties. First, session-key indistinguishability: an adversary, even one who can observe the single transmitted ciphertext, cannot tell the real session key from a random string. Second, sender authentication: the receiver can be confident the message originated from the claimed vessel within the claimed domain. Third, and more unusually, sender identity hiding: the public ciphertext itself does not leak who sent it, a property formalized through a defined identity-hiding experiment. Identity concealment matters at sea, where vessel movements and communications patterns can be commercially or strategically sensitive, and where broadcasting the sender’s identity in the clear would undermine the confidentiality the protocol is meant to provide.

Performance is where the scheme makes its case for practical deployment. The team implemented a prototype and measured it across multiple combinations of cryptographic primitives, including post-quantum key-encapsulation mechanisms aligned with the recently standardized module-lattice schemes from NIST, alongside classical elliptic-curve options. Across all evaluated combinations, both sender and receiver computation came in under one millisecond. That figure matters because shipboard hardware is often modest, and because the protocol is intended to sit underneath authenticated encryption modes such as Galois/Counter Mode, adding negligible overhead to the actual data exchange. The authors also quantify the communication cost of the cross-domain verification material, giving network planners a concrete measure of what the added security overhead looks like on a bandwidth-constrained maritime link.

The timing of this work is not accidental. Post-quantum cryptography has moved from theory to deployment, with NIST finalizing its module-lattice key-encapsulation and signature standards in 2024, and researchers across vehicular, edge, and unmanned-aerial settings racing to build authenticated key agreement that will survive quantum adversaries. Maritime systems, with their long equipment lifecycles and slow upgrade cycles, face particular pressure to adopt quantum-resistant primitives early. A scheme that already accommodates lattice-based KEMs and signatures, while tolerating the imperfect randomness of real embedded devices, positions itself for that transition. The work was supported in part by the National Natural Science Foundation of China and Shanghai municipal research programs, reflecting institutional investment in securing the digital maritime corridor.

What the Shanghai team has delivered, in essence, is a careful reconciliation of three demands that usually pull against each other: one-message efficiency for unreliable links, verifiable trust across administrative boundaries without live authority contact, and robustness against the entropy failures that plague real-world devices. None of these ingredients is entirely new on its own—hedged encryption, Merkle commitments, and one-pass key establishment each have established research lineages. The contribution lies in composing them into a protocol whose security properties are proven formally and whose cost has been measured, not merely estimated. As autonomous shipping, e-navigation services, and cross-border vessel data exchange expand, the plumbing that lets a ship under one flag prove itself to a receiver under another—in a single message, over a fading link, with imperfect hardware—may quietly become some of the most consequential cryptography on the water.

Subject of Research: Randomness-resilient one-pass authenticated key establishment for cross-domain maritime communication

Article Title: Randomness-Resilient One-Pass Authenticated Key Establishment for Cross-Domain Maritime Communication

Article References: Wei, L., Zhu, H., Meng, X., Yu, L., Li, X., Zhu, C., & Lei, H. (2026). Randomness-Resilient One-Pass Authenticated Key Establishment for Cross-Domain Maritime Communication. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02556-y

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02556-y

Keywords: authenticated key establishment, maritime communication, cross-domain authentication, weak randomness, key-encapsulation mechanism, Merkle commitment, post-quantum cryptography, random oracle model, identity hiding, certificate transparency, VHF data exchange, ship-to-ship security

The attack targets the Black-Gray-Flip decoder, known as BGF, which the latest BIKE specification recommends for its combination of a fixed number of iterations and favorable decoding-failure behavior. During each iteration, the decoder computes counters that tally unsatisfied parity-check equations for every bit position and compares those counters against a threshold to decide whether candidate bits should be flipped. Because this counter-computation function, often implemented as a routine called ctr, is invoked repeatedly within a single decoding execution, multiple secret-dependent decision points scatter their leakage across the entire measured waveform rather than confining it to convenient, fixed locations. The position and duration of each informative region shift with the evolving decoding state, which makes the resulting traces notoriously difficult to analyze with conventional techniques.

Previous demonstrations that BIKE implementations are vulnerable to side-channel attacks have relied on assumptions that break down in this setting. Earlier work by Cheriere and colleagues combined power consumption analysis with information-set decoding to recover secrets from a software implementation, while Beckwith and colleagues extracted full keys from a hardware implementation using only several dozen traces. A timing attack by Guo and colleagues also exploited input-dependent execution behavior. However, the leakage source exploited by Cheriere and colleagues no longer exists in the latest reference code, where the corresponding polynomial multiplication has been replaced with a constant-time routine. Moreover, all prior attacks depended on informative segments appearing at stable temporal locations that the attacker could identify and segment reliably, an assumption that fails when traces are captured in a fixed window containing timing jitter, silent intervals, and data-dependent duration variation.

The core insight of the new work is that recovering secrets from such long, temporally unstable traces should not be treated as a conventional fixed-window classification problem at all. Instead, the researchers reformulate the task as an alignment-free sequence-to-sequence translation: mapping a long physical waveform directly to a short target bit sequence, with the correspondence between waveform patterns and labels learned implicitly from data rather than imposed through manual segmentation. The specific target is a 16-bit sequence recording the first sixteen counter-comparison branch outcomes during BGF decoding. Each of these bits is a secret-indexed sample of the syndrome vector, because the index into the syndrome is determined by the compact representation of the private-key polynomial h0.

To instantiate this formulation, the team assembled a convolutional recurrent neural network trained with Connectionist Temporal Classification, or CTC, a technique borrowed from speech recognition where input and output lengths are inherently mismatched. The pipeline begins with lightweight preprocessing, applying band-pass filtering, Z-score normalization, and downsampling to the raw power traces. A multi-layer one-dimensional convolutional neural network then extracts local power-consumption signatures and compresses the trace along the temporal dimension. The resulting feature sequence feeds into a deep bidirectional long short-term memory network, stacked in two layers, which models long-range dependencies across the trace. The BiLSTM architecture is essential because informative leakage events are separated by long stretches of silent, key-independent activity, and its gated memory cells allow gradient information to flow across hundreds of time steps during training.

CTC solves the alignment problem that defeats rigid segmentation. The researchers measured that waveform segments associated with a branch-taken outcome occupy roughly 670 sample points, while skipped branches occupy only about 200, meaning that equal trace length does not imply semantic alignment. CTC introduces a blank symbol that absorbs silent intervals and surplus frames, and it marginalizes over all possible alignment paths during training, requiring no frame-level labels or manually annotated points of interest. At inference time, greedy decoding merges repeated labels and strips blank tokens to produce the final 16-bit estimate directly from the complete trace. An ablation study confirmed the importance of every component: removing the BiLSTM collapsed perfect sequence recovery from 95.68 percent to zero, removing the convolutional front-end dropped it to 84.49 percent, and an experiment retaining the identical CNN-BiLSTM encoder but replacing CTC with frame-wise cross-entropy achieved only 15.27 percent perfect recovery, an 80-percentage-point drop that isolates the alignment mechanism itself as the decisive factor.

The experimental campaign was conducted on an ARM Cortex-M4 development board running an unprotected reference implementation of BIKE in a profiled, same-platform setting. Using a Keysight oscilloscope, the team collected 21,200 power traces, each 8,333 sample points long and paired with a known 16-bit ground-truth sequence. Of these, 19,000 traces trained the model, 1,000 served as a validation set, and 1,200 formed an independent test set used solely for final evaluation. Training used PyTorch on an NVIDIA RTX 4090 GPU with the Adam optimizer, a batch size of 128, and thirty epochs. Against rigid-segmentation baselines, the contrast was stark: a CNN-plus-template-matching pipeline achieved only 0.32 percent perfect recovery, and a CRNN constrained to fixed partitions reached 5.60 percent, underscoring that a strong backbone cannot compensate for unreliable temporal boundaries.

The authors are careful to delimit what the attack achieves. The recovered 16-bit sequence is a private-key-dependent intermediate, not the complete BIKE private key. Full key recovery would require accumulating such observations over multiple chosen-ciphertext executions, for example by sending ciphertexts that force the syndrome vector into cyclic rotations of the private-key polynomial, and then applying information-set decoding or combinatorial post-processing of the kind used in earlier BIKE attacks. The study demonstrates and validates this core leakage-extraction step but leaves the complete reconstruction pipeline as future work. The results also apply specifically to a profiled, unprotected, same-platform evaluation; the researchers note that robustness across different devices, acquisition sessions, implementations, keys, and countermeasures such as masking or instruction shuffling remains untested.

Nevertheless, the implications for the post-quantum transition are significant. BIKE is a round-4 candidate in the NIST standardization process, and its latest specification adopted the BGF decoder precisely because it simplifies constant-time implementation. This study shows that even the current reference code, with its most recent countermeasures, remains practically exploitable by a neural attack that needs no manual points of interest and tolerates wildly irregular leakage timing. The alignment-free sequence-to-sequence formulation may also transfer to other code-based schemes and to FPGA or ASIC implementations, where leakage structure differs from software. As quantum-resistant algorithms move from laboratories into real-world infrastructure, the work sends a clear warning to implementers: algorithmic security guarantees mean little unless physical leakage is assessed and mitigated with equal rigor, and the tools that attackers bring to that assessment are growing steadily more powerful.

Subject of Research: A deep learning based side-channel attack recovering private-key-dependent sequences from the BIKE post-quantum key encapsulation mechanism

Article Title: A deep learning based side-channel attack on BIKE

Article References: Chen, G., Li, Y., Sun, S., Wang, Z., Ge, C., Wu, F., & Xu, Q. (2026). A deep learning based side-channel attack on BIKE. Cybersecurity, 9(1), Article 215. https://doi.org/10.1186/s42400-026-00653-9

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00653-9

Keywords: post-quantum cryptography, BIKE, side-channel attack, deep learning, CRNN, connectionist temporal classification, power analysis, ARM Cortex-M4, BGF decoder, key encapsulation mechanism, sequence-to-sequence, cybersecurity