- Researchers demonstrated that only 200 power traces were sufficient for machine learning models to predict secret bits of the shared session key in code-based post-quantum cryptosystems (arXiv:2605.17116).
- The leak occurs during the decapsulation phase of McEliece and BIKE — schemes that are mathematically resilient to quantum attacks but exposed at the physical layer.
- Larger key sizes defeat structural attacks but do nothing against power and electromagnetic side channels. Your PQC migration plan needs a hardware hardening track, not just an algorithm swap.
Why a Quantum-Safe Algorithm Can Still Leak Your Keys
Your organization picks McEliece because it has survived four decades of cryptanalysis and resists Shor’s algorithm. You select a conservative key size, satisfy the structural-security checkbox, and move the project to deployment. Then an attacker with a bench-grade probe sits next to the device and reads the secret bits out of its power consumption — without touching the math at all.
That is the scenario described in “Simple Power Analysis on Post-Quantum Code Based Cryptosystems” (arXiv:2605.17116). The researchers used Simple Power Analysis (SPA) with low-cost equipment to capture information leaking from the decapsulation step, where the shared secret is reconstructed. They found a measurable correlation between the device’s electromagnetic emissions and the secret values being processed — and then trained machine learning models to turn that correlation into key bits.
The headline number is what makes this urgent for any team running code-based PQC in hardware or firmware:
“With only 200 power traces collected, machine learning models can predict secret bits of the shared session key, produced during the decapsulation.” — Simple Power Analysis on Post-Quantum Code Based Cryptosystems (arXiv:2605.17116)
Two hundred traces is a trivial collection effort. A side-channel campaign that needs millions of traces is a research curiosity; one that needs a few hundred is an operational threat against any device an attacker can physically reach — point-of-sale terminals, IoT gateways, smartcards, hardware security modules in shared colocation.
What “Code-Based Post-Quantum Cryptography” Actually Means
Code-based cryptography is a family of public-key schemes whose security rests on the hardness of decoding a general linear error-correcting code — a problem with no known efficient solution on either classical or quantum computers. McEliece (1978) and BIKE (Bit Flipping Key Encapsulation) are the two best-known members. Because their hardness assumption is unrelated to integer factorization or discrete logarithms, they remain secure when a cryptographically relevant quantum computer arrives.
The research confirms the algorithmic point and then pivots to the implementation gap:
- Structural attacks against McEliece and BIKE can be neutralized by choosing an appropriate key size. This is a parameter-selection problem, and it is solved.
- Side-channel attacks target the physical execution, not the algorithm. The decapsulation routine — the operation that recovers the shared secret from a ciphertext — manipulates secret-dependent data, and that data shapes the device’s power draw.
This distinction is the whole point. Quantum resistance is a property of the mathematics. Side-channel resistance is a property of the silicon and the code that runs on it. They are independent, and a deployment can pass one while failing the other.
Why Decapsulation Is the Soft Target
Decapsulation is where the secret key meets attacker-controlled input. The device takes a ciphertext and applies the private key to reconstruct the session key. Every conditional branch, memory access, or arithmetic operation that depends on a secret bit can modulate power consumption. SPA reads that modulation directly from a single or small set of traces — no statistical averaging over millions of samples required, which is what separates SPA from the more familiar Differential Power Analysis.
Current Threat Model vs. the Demonstrated Attack
| Dimension | Conventional PQC Threat Model | Demonstrated SPA Attack (arXiv:2605.17116) |
|---|---|---|
| Adversary capability | Quantum computer running Shor’s/structural attacks | Physical proximity + low-cost power probe |
| Target | The algorithm’s hardness assumption | The decapsulation implementation |
| Primary defense | Larger key size | Masking, constant-time code — key size is irrelevant |
| Data required | N/A (mathematical) | ~200 power traces |
| Analysis method | Cryptanalysis | Machine learning on power/EM emissions |
| What it recovers | Theoretical key recovery | Secret bits of the shared session key |
| Status of defense | Solved via parameter choice | Requires implementation-level countermeasures |
The right-hand column is the part most migration roadmaps ignore. Teams budget for the key-size and performance trade-off and treat the implementation as a downstream engineering detail. The 200-trace result inverts that priority for any deployment exposed to physical access.
Industry Context: Standardization Solved the Wrong Half
NIST’s post-quantum standardization effort has driven the industry to focus on algorithmic selection — which schemes, which parameter sets, which key sizes. That work is necessary and largely done for the leading candidates. But certification and procurement language still under-weights implementation security, and this research is a direct argument for closing that gap.
Selecting a larger key size defeats structural attacks and does nothing against power or electromagnetic side channels. Post-quantum security must be evaluated holistically — algorithm, implementation, and physical leakage together — or the “quantum-safe” label is only half-earned.
The economic asymmetry is what should worry a CISO. The cost of inaction is a quantum-resistant scheme that leaks its keys to a $1,000 lab bench. The cost of mitigation is well-understood engineering — masking, constant-time decapsulation, shielding — applied during integration rather than retrofitted after a breach. ML-assisted analysis that succeeds on 200 traces lowers the attacker’s barrier and raises the urgency of doing that engineering before deployment, not after.
Who Is Exposed
Any system that performs decapsulation on hardware an attacker can physically approach is in scope: smartcards and secure elements, embedded IoT and OT controllers, automotive ECUs, payment terminals, and HSMs in multi-tenant facilities. Cloud-only key operations behind strong physical security are lower-risk on this specific vector — but the moment a private key operation runs on an edge device, the threat model changes.
The BeQuantum Perspective
This research validates the design principle behind our PQC Layer and IceCase hardware: a post-quantum deployment is only as strong as the device that executes it. We treat decapsulation as a hostile-environment operation by default.
Concretely, the approach we apply for organizations adopting code-based schemes is layered. At the silicon level, IceCase isolates private-key operations so that decapsulation runs with constant-time control flow and masked intermediate values — the secret-dependent branches that SPA reads simply are not present in the power signature. At the protocol level, the PQC Layer treats every recovered session key as a measured artifact rather than a trusted output, and our Digital Notary anchors a tamper-evident record of which device performed which key operation, so an exfiltration attempt against a single endpoint does not silently compromise the wider trust chain.
The point is not that any single product makes side channels disappear — they do not, and any vendor claiming otherwise is selling. The point is that the evaluation criteria have to expand. “Is it quantum-safe?” is the wrong question on its own. “Is it quantum-safe and does its decapsulation routine resist a 200-trace power analysis?” is the question that matches the actual threat.
What You Should Do Next
- Within 90 days, inventory every device that performs PQC decapsulation outside a physically secured boundary. Flag smartcards, edge gateways, and any HSM in shared facilities. These are your exposed surface for this attack class.
- Add side-channel resistance to your PQC procurement and certification criteria — now, not at the next refresh. Require evidence of constant-time decapsulation and masking from vendors. A key-size spec sheet is not a side-channel assurance.
- Commission a power/EM leakage assessment on your highest-value code-based deployment before scaling it. If 200 traces is the published bar, your internal red team should be able to reproduce the methodology cheaply; budget for that test as part of the migration, not as a post-incident response.
FAQ
Q: Does this attack break McEliece or BIKE as algorithms? A: No. The algorithms remain quantum-resistant; their structural security is unaffected and is handled by choosing an appropriate key size. The attack targets the physical implementation of the decapsulation step, recovering secret bits from power consumption rather than from any mathematical weakness.
Q: Is increasing the key size a valid defense here? A: No, and that is the central warning of the research. Larger keys stop structural attacks but have no effect on power or electromagnetic leakage. The countermeasures are implementation-level — masking, constant-time code, and physical shielding — applied to the decapsulation routine itself.
Q: How realistic is a 200-trace attack in practice? A: For any device an attacker can physically access, very realistic. The research used Simple Power Analysis with low-cost equipment, and 200 traces is a small collection effort compared with the millions some side-channel techniques require. Devices behind strong physical security and audited remote-only key operations are lower-risk on this specific vector.
Note on scope: the source abstract does not specify the exact key sizes tested, the device under analysis, the machine learning model used, or its precise accuracy. The findings above reflect what the research states; implementation specifics should be confirmed against the full paper before acting on a particular platform.
Last updated: 2026-05-31. Primary source: Simple Power Analysis on Post-Quantum Code Based Cryptosystems.
