Research seriesL3algorithms
A mathematically secure scheme still leaks through its implementation. Post-quantum cryptography introduces new side-channel surfaces - sampling, the number-theoretic transform, rejection - that classical crypto never had. This series is the attacker's-eye tour: the threat model, the decapsulation timing oracle, power and electromagnetic attacks, masking countermeasures, and how to verify constant-time. Grounded in the side-channel literature and NIST KEM guidance.
A scheme secure on paper still leaks through timing, power, and electromagnetic emanations — and post-quantum cryptography adds new leaky surfaces (sampling, the transform, rejection) that classical schemes never had.
The Fujisaki-Okamoto transform removed the chosen-ciphertext oracle in theory. A variable-time comparison or rejection in decapsulation quietly hands it back — and a few thousand timed queries recover the whole secret key.
The number-theoretic transform and the noise sampler are where a lattice scheme's secret is richest — and where power and electromagnetic analysis, including single-trace attacks that defeat ephemeral keys, strike.
Masking splits each secret into random shares so no single wire carries it. Post-quantum schemes mix arithmetic and Boolean operations, forcing expensive conversions and quadratic overhead for provable side-channel resistance.
A constant-time claim is worthless unless demonstrated on the actual compiled binary and hardware. Statistical timing tests, formal analysis, and leakage assessment together turn the claim into evidence.