ML-KEM, standardized in NIST’s FIPS 203 and derived from the CRYSTALS-Kyber scheme, is the flagship lattice-based key-encapsulation mechanism intended to replace vulnerable key-exchange methods in the quantum era. Its mathematical security rests on the hardness of the Module Learning With Errors problem, a lattice problem believed to resist attacks even from large-scale quantum computers. But mathematical security is only as strong as the hardware that implements it. Side-channel analysis exploits physical observables, such as power consumption, electromagnetic emissions, or timing variations, to extract secret information without ever attacking the underlying mathematics directly.

The Tsinghua team, led by Munkhbaatar Chinbat with Liji Wu, Xiangmin Zhang, and Munkhnar Khulan, targeted the Number Theoretic Transform, or NTT, the arithmetic engine at the heart of ML-KEM. The NTT is a fast polynomial multiplication technique that converts secret coefficients into a transformed domain where multiplication becomes efficient. During decryption key generation, the secret vector is sampled from a centered binomial distribution and immediately transformed into the NTT domain before being stored. That transformation, the researchers realized, is a rich source of exploitable leakage because it processes every secret coefficient through well-defined, repetitive butterfly operations.

The structure of the first NTT round is what makes the attack possible. The transform operates on 256 coefficients arranged into 128 pairs, and in the first round every pair is processed with the same public twiddle factor. This means the power signature of each butterfly operation depends almost entirely on the secret input values, not on public data that could mask the leakage. Because the team’s accelerator processes coefficient pairs sequentially, the leakage from each pair occupies a distinct, predictable window in time, allowing an attacker to cleanly separate the fingerprints of all 128 pairs from a single recording.

To build their experimental platform, the researchers implemented a deliberately naive NTT accelerator on a Xilinx Artix-7 FPGA hosted on a CW305 board, using a ChipWhisperer-Lite for power trace acquisition. The design uses a single butterfly unit, a finite state machine controller, shared memory, and standard Montgomery and Barrett reduction techniques for modular arithmetic, mirroring the reference implementation of Kyber. The accelerator runs at 8.5 megahertz while the ADC samples power at roughly 105 million samples per second, with each trace capturing 20,000 sample points covering the entire first NTT stage. The minimalist design required only 743 lookup tables, 403 registers, one DSP block, and one block RAM, trading speed for simplicity and analyzability.

The attack methodology unfolds in two phases. In the profiling phase, the attacker trains on a clone device with known inputs. The team collected 100,000 power traces, using 80,000 for building statistical templates and 20,000 for the attack itself. Before any modeling, they applied the Test Vector Leakage Assessment, a statistical t-test comparing fixed versus random inputs, to pinpoint the exact time samples where secret-dependent information leaks. Any sample where the t-statistic exceeded 4.5 in absolute value, corresponding to a confidence level of 99.999 percent, was flagged as a point of interest. For each of the 128 coefficient pairs, these points were then compressed using principal component analysis, reducing thousands of raw samples to a handful of informative features.

Classification then proceeds via Mahalanobis distance, a statistical measure that accounts for the covariance structure of the leakage data. For every possible coefficient value pair, the profiling phase stores a mean vector and covariance matrix describing what its power signature typically looks like. During the attack, an unknown trace is compared against all templates, and the closest match reveals the secret coefficients. The results were striking: classification accuracy ranged from 96.93 to 97.97 percent across all 128 coefficient pairs, with an average near 97.4 percent. Notably, this classical statistical approach outperformed the team’s earlier deep-learning experiments with multilayer perceptrons, convolutional networks, and recurrent networks, which topped out at 96.64 percent accuracy.

Single traces, however, were not always sufficient. The team’s overlap analysis showed that only a small fraction of individual traces classified all 128 pairs correctly in one shot, since certain coefficient combinations, such as symmetric pairs like (1, -1) and (-1, 1), produce nearly identical power signatures. The solution is likelihood aggregation: by accumulating classification evidence across multiple decapsulation operations, the correct values emerge statistically. The guessing entropy analysis, which measures the expected rank of the correct answer among all candidates, dropped from 11.15 with 150 traces to just 1.09 with 10,000 traces, confirming that the templates converge rapidly toward certainty. Across 734 successful recovery trials, the number of traces needed for full polynomial recovery ranged from 7 to 92, with a mean of 27.3 and a median of 23.

The findings place ML-KEM hardware in a sobering context. Previous research had already demonstrated that software implementations on Cortex-M4 processors leak enough information for full key extraction with as few as 8 to 960 traces, and that masked and shuffled implementations can be broken with single traces when fault injection is combined with side-channel analysis. The new work extends this vulnerability picture to lightweight FPGA accelerators, showing that even a minimal, sequential NTT design without any countermeasures is effectively defenseless against a well-resourced profiling attacker. Because ML-KEM’s secret key consists of multiple polynomials, three for ML-KEM-768 and four for ML-KEM-1024, full key recovery simply requires repeating the polynomial-level attack for each component.

The researchers emphasize that their attack targets an unprotected design, and that more sophisticated architectures using parallelism or pipelining may present a smaller attack surface by blurring the temporal correlation of leakage. Still, the message for the post-quantum transition is clear: theoretical quantum resistance means nothing if the hardware leaks. The team proposes countermeasures including physically unclonable function-based address shuffling and higher-order masking, and points toward hybrid attacks that would feed template-attack likelihoods into belief-propagation frameworks such as Soft Analytical Side-Channel Attacks to reduce the trace requirements even further. As ML-KEM deployment accelerates across browsers, banks, and national infrastructure, the study serves as a warning that securing the mathematics is only half the battle; the silicon running it must be hardened against the whispers of its own power supply.

Subject of Research: A template-based side-channel attack recovering ML-KEM decryption keys from power leakage of an FPGA NTT accelerator

Article Title: A Template attack for decryption key recovery on the NTT accelerator of PQC ML-KEM

Article References: Chinbat, M., Wu, L., Zhang, X., & Khulan, M. (2026). A Template attack for decryption key recovery on the NTT accelerator of PQC ML-KEM. Cybersecurity, 9(1), Article 226. https://doi.org/10.1186/s42400-026-00675-3

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00675-3

Keywords: ML-KEM, post-quantum cryptography, side-channel attack, template attack, Number Theoretic Transform, FPGA, power analysis, TVLA, principal component analysis, CRYSTALS-Kyber, decryption key recovery, NIST FIPS 203

The attack targets the Black-Gray-Flip decoder, known as BGF, which the latest BIKE specification recommends for its combination of a fixed number of iterations and favorable decoding-failure behavior. During each iteration, the decoder computes counters that tally unsatisfied parity-check equations for every bit position and compares those counters against a threshold to decide whether candidate bits should be flipped. Because this counter-computation function, often implemented as a routine called ctr, is invoked repeatedly within a single decoding execution, multiple secret-dependent decision points scatter their leakage across the entire measured waveform rather than confining it to convenient, fixed locations. The position and duration of each informative region shift with the evolving decoding state, which makes the resulting traces notoriously difficult to analyze with conventional techniques.

Previous demonstrations that BIKE implementations are vulnerable to side-channel attacks have relied on assumptions that break down in this setting. Earlier work by Cheriere and colleagues combined power consumption analysis with information-set decoding to recover secrets from a software implementation, while Beckwith and colleagues extracted full keys from a hardware implementation using only several dozen traces. A timing attack by Guo and colleagues also exploited input-dependent execution behavior. However, the leakage source exploited by Cheriere and colleagues no longer exists in the latest reference code, where the corresponding polynomial multiplication has been replaced with a constant-time routine. Moreover, all prior attacks depended on informative segments appearing at stable temporal locations that the attacker could identify and segment reliably, an assumption that fails when traces are captured in a fixed window containing timing jitter, silent intervals, and data-dependent duration variation.

The core insight of the new work is that recovering secrets from such long, temporally unstable traces should not be treated as a conventional fixed-window classification problem at all. Instead, the researchers reformulate the task as an alignment-free sequence-to-sequence translation: mapping a long physical waveform directly to a short target bit sequence, with the correspondence between waveform patterns and labels learned implicitly from data rather than imposed through manual segmentation. The specific target is a 16-bit sequence recording the first sixteen counter-comparison branch outcomes during BGF decoding. Each of these bits is a secret-indexed sample of the syndrome vector, because the index into the syndrome is determined by the compact representation of the private-key polynomial h0.

To instantiate this formulation, the team assembled a convolutional recurrent neural network trained with Connectionist Temporal Classification, or CTC, a technique borrowed from speech recognition where input and output lengths are inherently mismatched. The pipeline begins with lightweight preprocessing, applying band-pass filtering, Z-score normalization, and downsampling to the raw power traces. A multi-layer one-dimensional convolutional neural network then extracts local power-consumption signatures and compresses the trace along the temporal dimension. The resulting feature sequence feeds into a deep bidirectional long short-term memory network, stacked in two layers, which models long-range dependencies across the trace. The BiLSTM architecture is essential because informative leakage events are separated by long stretches of silent, key-independent activity, and its gated memory cells allow gradient information to flow across hundreds of time steps during training.

CTC solves the alignment problem that defeats rigid segmentation. The researchers measured that waveform segments associated with a branch-taken outcome occupy roughly 670 sample points, while skipped branches occupy only about 200, meaning that equal trace length does not imply semantic alignment. CTC introduces a blank symbol that absorbs silent intervals and surplus frames, and it marginalizes over all possible alignment paths during training, requiring no frame-level labels or manually annotated points of interest. At inference time, greedy decoding merges repeated labels and strips blank tokens to produce the final 16-bit estimate directly from the complete trace. An ablation study confirmed the importance of every component: removing the BiLSTM collapsed perfect sequence recovery from 95.68 percent to zero, removing the convolutional front-end dropped it to 84.49 percent, and an experiment retaining the identical CNN-BiLSTM encoder but replacing CTC with frame-wise cross-entropy achieved only 15.27 percent perfect recovery, an 80-percentage-point drop that isolates the alignment mechanism itself as the decisive factor.

The experimental campaign was conducted on an ARM Cortex-M4 development board running an unprotected reference implementation of BIKE in a profiled, same-platform setting. Using a Keysight oscilloscope, the team collected 21,200 power traces, each 8,333 sample points long and paired with a known 16-bit ground-truth sequence. Of these, 19,000 traces trained the model, 1,000 served as a validation set, and 1,200 formed an independent test set used solely for final evaluation. Training used PyTorch on an NVIDIA RTX 4090 GPU with the Adam optimizer, a batch size of 128, and thirty epochs. Against rigid-segmentation baselines, the contrast was stark: a CNN-plus-template-matching pipeline achieved only 0.32 percent perfect recovery, and a CRNN constrained to fixed partitions reached 5.60 percent, underscoring that a strong backbone cannot compensate for unreliable temporal boundaries.

The authors are careful to delimit what the attack achieves. The recovered 16-bit sequence is a private-key-dependent intermediate, not the complete BIKE private key. Full key recovery would require accumulating such observations over multiple chosen-ciphertext executions, for example by sending ciphertexts that force the syndrome vector into cyclic rotations of the private-key polynomial, and then applying information-set decoding or combinatorial post-processing of the kind used in earlier BIKE attacks. The study demonstrates and validates this core leakage-extraction step but leaves the complete reconstruction pipeline as future work. The results also apply specifically to a profiled, unprotected, same-platform evaluation; the researchers note that robustness across different devices, acquisition sessions, implementations, keys, and countermeasures such as masking or instruction shuffling remains untested.

Nevertheless, the implications for the post-quantum transition are significant. BIKE is a round-4 candidate in the NIST standardization process, and its latest specification adopted the BGF decoder precisely because it simplifies constant-time implementation. This study shows that even the current reference code, with its most recent countermeasures, remains practically exploitable by a neural attack that needs no manual points of interest and tolerates wildly irregular leakage timing. The alignment-free sequence-to-sequence formulation may also transfer to other code-based schemes and to FPGA or ASIC implementations, where leakage structure differs from software. As quantum-resistant algorithms move from laboratories into real-world infrastructure, the work sends a clear warning to implementers: algorithmic security guarantees mean little unless physical leakage is assessed and mitigated with equal rigor, and the tools that attackers bring to that assessment are growing steadily more powerful.

Subject of Research: A deep learning based side-channel attack recovering private-key-dependent sequences from the BIKE post-quantum key encapsulation mechanism

Article Title: A deep learning based side-channel attack on BIKE

Article References: Chen, G., Li, Y., Sun, S., Wang, Z., Ge, C., Wu, F., & Xu, Q. (2026). A deep learning based side-channel attack on BIKE. Cybersecurity, 9(1), Article 215. https://doi.org/10.1186/s42400-026-00653-9

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00653-9

Keywords: post-quantum cryptography, BIKE, side-channel attack, deep learning, CRNN, connectionist temporal classification, power analysis, ARM Cortex-M4, BGF decoder, key encapsulation mechanism, sequence-to-sequence, cybersecurity