PQC Implementations Still Leak: SCA and FI Risks in Dilithium & Kyber

Post-quantum cryptography (PQC) is built to withstand large-scale quantum computers. While PQC holds up in theory, once these algorithms run on real devices, they produce measurable physical effects and fault conditions that attackers may exploit. In this article, we highlight where PQC lattice schemes like Dilithium (ML-DSA) and Kyber (ML-KEM) leak or break, and how to harden real systems with measurement-driven assurance.

Adams Bridge Pre-Release SCA Findings

Adams Bridge is designed to provide hardware acceleration for Dilithium, helping to bridge the gap between classical and quantum-resilient cryptography. Integrated into open-source platforms like Caliptra (a hardware Root of Trust), it is intended to fast-track the adoption of PQC and increase the trustworthiness of hardware security by offering a transparent, verifiable implementation.

In the pre-release revision, researchers demonstrated a successful Correlation Power Analysis (CPA) targeting its ML-DSA signing path. The attack focused on exploiting leakage during the modular reduction process and leveraging the zeroization mechanism used for secure data erasure. The researchers behind this work successfully recovered partial secret key coefficients with a 99.99% success rate using just 10,000 power traces. This capability enables adversaries to fully extract the secret keys, allowing them to forge signatures for certificate generation and thus compromise the integrity of the root of trust within the framework.

The implementation discussed contains several vulnerabilities, primarily focusing on side-channel attacks exploiting the hardware design. The primary vulnerabilities identified include:

Side-Channel Leakage in Modular Reduction: The attack targets the Number Theoretic Transform (NTT)-based polynomial pointwise multiplication operations used in ML-DSA. This involves exploiting the side-channel leakage from modular reduction, as adversaries can extract secret keys by analyzing power consumption.
Deterministic Behavior: The implementation uses a deterministic signing approach in ML-DSA, which leaves it open to side-channel attacks. The lack of randomness in operation makes it easier for adversaries to predict and control input-output relationships, which significantly enhances the attack's effectiveness.
Zeroization Mechanism: Although implemented as per security standards, the zeroization process inadvertently simplifies side-channel attacks by resetting registers to a known state. This reduces the complexity of guessing initial states during attacks, thereby aiding attackers in calculating important values like Hamming distance more efficiently.
No Advanced Countermeasures: The design lacks advanced countermeasures such as masking or shuffling, making it highly susceptible to power analysis attacks. The absence of these techniques allows sensitive information to be leaked more easily through side-channel attacks.

These findings highlight a crucial lesson: even the most theoretically secure algorithms require comprehensive, state-of-the-art countermeasures to resist real-world physical attacks. They also demonstrate the value of uncovering such leakage in a pre-release stage, allowing the final design of Adams Bridge to be strengthened before deployment.

Defeating “fixed” lattice-signature countermeasures

Recent work shows that common fault countermeasures for lattice-based signatures, specifically those built on the Fiat–Shamir with aborts paradigm, can be bypassed. Building on Espitau et al.’s loop-abort fault attack (which injects a fault during the commitment vector sampling), the new study revisits two recommended defenses—shuffling coefficient sampling and rejecting low-degree polynomials—and demonstrates they’re ineffective against a refined attack.

The key idea is to treat faulty signatures as a noisy linear system and solve it with integer linear programming (ILP). When at least one coefficient of the commitment vector remains at its initial value, ILP efficiently recovers the secret. In an end-to-end proof-of-concept on Dilithium (ARM Cortex-M4), the authors recover the key in less than 4 minutes using five faulted signatures; with more faulty signatures, recovery consistently finishes in less than 5 minutes.

Why this matters: loop-abort style faults remain a practical threat to PQC implementations. “Partial fixes” that add randomness or filter certain polynomials don’t stop an attacker who can collect a handful of faulty outputs and run ILP offline.

When NTT Meets SIS

A recent study, “When NTT Meets SIS: Efficient Side-channel Attacks on Dilithium and Kyber,” demonstrates how side-channel leakage from NTT-based implementations (e.g., Dilithium, Kyber) can be leveraged to significantly accelerate key recovery. The trick is to cast the leaked NTT computations into an instance of the Short Integer Solution (SIS) problem and then solve it efficiently, even when the leakage is incomplete.

The result is a sharp drop in traces and time-to-key (this experiment reduced Dilithium2 recovery from about 82 hours to roughly one minute), and the method remains effective even with incomplete leakage, making any NTT-heavy implementation with measurable side-channel signals a credible target.

What’s going on

NTT (Number Theoretic Transform): the fast polynomial engine at the heart of lattice schemes.
Side-channel leakage: power/EM measurements reveal (partial) NTT coefficients and intermediate values.
SIS embedding: The NTT transformation matrix is embedded into an SIS search problem, allowing an attacker to use lattice tools to reconstruct secrets even from noisy and partial data.

How the attack works

Use CPA to recover partial information (some of the coefficients) of the secret key from the NTT operations.
Embed the NTT matrix into an SIS instance derived from the side-channel equations.
Divide-and-conquer reduction lowers the problem dimension using the NTT structure, making the instance easier.
Lattice solving (BKZ), applied to the reduced SIS system, recovers the private key even if some coefficients are missing.

The root cause is that the power consumption of a physical device (like an embedded processor or FPGA) is data-dependent. This means that the secret value can unintentionally affect how much power the device consumes at any given moment.

Intermediate Values: While performing secret-dependent operations like Montgomery multiplication during the NTT, the device temporarily stores intermediate values in its registers. These values depend on the secret key and can influence the device’s power consumption, making them a source of side-channel leakage.
Correlation: CPA works by guessing small parts of the secret key (e.g., a few bits or a single coefficient). The attacker then models the hypothetical power consumption for that key guess (often using the Hamming Weight or Hamming Distance model) and computes the Pearson correlation between the hypothetical power and the real, measured power trace.
Key Recovery: The key guess that results in a high correlation peak at the right moment in time is likely the correct part of the secret key. This process is repeated to recover the full vector.

Dive deeper into CPA on Dilithium in our video demo.

Conclusion: Why SCA and FI still work on PQC

Complex math, concrete devices. PQC algorithms rely on structured number-theoretic operations (e.g., NTT, modular reduction, rejection sampling). These computations produce data-dependent activity in caches, buses, multipliers, and instruction flow.
Constant-time is necessary but not sufficient. Even constant-time code can leak through data-dependent power, EM, or timing micro-effects at the micro-architectural layer.
Faults bypass checks. Redundancy and tight verification are critical. A single skipped subtraction, altered hint, or perturbed rejection test can flip a pass/fail decision or reveal key material.

Ship with proof, not hope

Measure leakage: Use TVLA (Test Vector Leakage Assessment) with both power and electromagnetic (EM) analysis to detect side-channel leakage; focus on high-risk components such as NTT/INTT, sampling routines, and verification paths; repeat per silicon/firmware change.
Targeted attacks in validation: use CPA to confirm leakage is low and correlation is negligible; run FI to harden acceptance logic (duplicate compares, re-verify before release, eliminate magic early-exit values).
Engineer for resilience: full masking/blinding, table-free butterflies, constant-time reducers, robust DMA/cache discipline, and fault sensors.

If you’re integrating PQC into a RoT or secure-boot path, we can help scope a focused TVLA/CPA/FI pilot and provide certification-ready evidence. Learn more about Keysight PQC testing solutions and services on our web page, or reach out to our team at [email protected].

limit