A new peer-reviewed study presented at LightSec 2026 has identified a previously undocumented side-channel vulnerability affecting ML-KEM, the key encapsulation mechanism chosen by the US National Institute of Standards and Technology as a core standard for post-quantum cryptography. The research, conducted by SEALSQ, demonstrates that the key generation process underlying ML-KEM can leak sensitive information through physical side channels, raising questions about how securely the algorithm behaves once it moves from mathematical theory into real hardware.
Why Key Generation Matters
ML-KEM, standardized as part of the effort to prepare encryption for the eventual arrival of practical quantum computers, relies on lattice-based mathematics considered resistant to quantum attacks. But cryptographic strength on paper does not guarantee safety in practice. Side-channel attacks do not try to break the underlying math; instead, they exploit the physical behavior of a device while it performs calculations - power consumption, electromagnetic emissions, or timing variations can all betray fragments of a secret key. Because key generation happens early and repeatedly in any cryptographic system, a weakness there can undermine everything built on top of it.
A Hybrid Attack Strategy
What distinguishes SEALSQ's findings is the method used to exploit this weakness. The study describes a hybrid approach that combines profiling techniques, which build statistical models of a device's physical emissions during known operations, with lattice reduction, a mathematical technique used to solve the hard problems that underpin lattice-based cryptography. By merging these two approaches, the researchers were able to extract sensitive key material more efficiently than either method could achieve on its own. This matters because efficiency is often the deciding factor in whether a theoretical attack becomes a practical threat: an attack that takes an impractical amount of time or resources is a curiosity, while one that works within realistic constraints is a genuine risk to deployed systems.
Countermeasures and Industry Implications
Alongside the attack, SEALSQ proposed practical countermeasures intended to harden ML-KEM implementations against this class of exploitation. Side-channel defenses typically involve techniques such as masking sensitive computations, randomizing execution timing, or restructuring algorithms so that physical signals carry less exploitable information. The value of this research lies as much in these proposed fixes as in the vulnerability itself, since responsible disclosure paired with mitigation strategies is what allows standards bodies and chipmakers to respond before attackers can exploit the same weakness.
The findings reinforce a broader reality facing the transition to post-quantum cryptography: algorithm selection is only the first step. Secure implementation in silicon is where theoretical resistance to quantum attacks meets the messy physical world of voltage fluctuations and electromagnetic leakage. SEALSQ has positioned this work as part of its ongoing development of secure hardware, including its Quantum Shield QS7001 chip, which is designed to embed post-quantum protections directly into semiconductor products.
What This Means Going Forward
As governments and industries move toward mandatory post-quantum migration timelines, findings like this one serve as a reminder that cryptographic agility must extend beyond swapping algorithms. Hardware manufacturers, standards bodies, and security auditors will need to treat side-channel resistance as a continuous area of scrutiny rather than a box checked once at certification. For organizations planning long-term data protection strategies, the lesson is straightforward: the strength of post-quantum cryptography will ultimately be judged not only by its mathematics, but by how faithfully that math is protected once it runs on physical chips.
