Simple Power Analysis on Post-Quantum Code Based Cryptosystems
Pith reviewed 2026-05-20 14:47 UTC · model grok-4.3
The pith
Machine learning models recover secret bits from post-quantum code-based cryptosystems using only 200 power traces collected during decapsulation.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
During the decapsulation phase of McEliece and BIKE, electromagnetic emissions correlate with the secret values being operated on, and this correlation is strong enough that machine learning classifiers trained on only 200 traces can predict bits of the generated shared session key.
What carries the argument
Simple Power Analysis (SPA) on electromagnetic side-channel emissions during decapsulation, followed by supervised machine learning to map trace patterns to secret key bits.
If this is right
- Implementations of McEliece and BIKE must incorporate side-channel countermeasures if they are to protect the shared secret.
- Low-cost equipment is sufficient to mount the attack, lowering the barrier for practical evaluation of post-quantum candidates.
- The leakage occurs specifically in the decapsulation routine that produces the session key, pointing to a narrow but critical window for protection.
Where Pith is reading between the lines
- Similar leakage patterns may appear in other code-based post-quantum proposals that follow comparable decapsulation logic.
- Hardware or software masking of the intermediate values could be tested as a direct countermeasure on the same platforms.
- The result suggests that side-channel evaluation should become a standard part of the security analysis for any new post-quantum standard.
Load-bearing premise
The observed link between electromagnetic emissions and secret values arises from the cryptographic calculations themselves rather than from unrelated factors in the measurement environment or hardware setup.
What would settle it
Run the same 200-trace collection on an isolated, shielded setup with no correlation between measured emissions and the known secret bits processed in decapsulation; if machine learning accuracy then drops to random guessing, the leakage claim does not hold.
Figures
read the original abstract
Post-Quantum cryptography is about to substitute current cryptographic schemes as being resilient in attacks from quantum computers. McEleiece and Bit Flip Key Encapsulation (BIKE) are two delight representatives based on coding theory where classical structural attacks against these algorithms can be successfully phased out by selecting the appropriate key size. Using low cost equipment, the method of Simple Power Analysis (SPA) is used in this paper to evaluate whether or not there is significant information leakage during the decapsulation phase where the shared secret key is generated. Executing a related experiment it is shown that correlation between electromagnetic emissions and secret values exists. In the aftermath, with only 200 power traces collected, machine learning models can predict secret bits of the shared session key, produced during the decapsulation.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript investigates side-channel vulnerabilities in the post-quantum code-based schemes McEliece and BIKE. It applies Simple Power Analysis (SPA) to electromagnetic emissions collected during the decapsulation phase, reports an observed correlation between these emissions and secret values, and claims that machine-learning models trained on only 200 traces can predict individual secret bits of the shared session key.
Significance. If the experimental observations are reproducible and the leakage is demonstrably tied to the cryptographic operations rather than measurement artifacts, the result would provide concrete evidence that these PQC candidates remain susceptible to low-trace side-channel attacks. This would strengthen the case for mandatory countermeasures in hardware implementations and contribute to the growing literature on practical attacks against code-based KEMs.
major comments (2)
- [Abstract] Abstract and experimental description: the central claim that ML models predict secret bits from 200 traces is presented without any quantitative performance metrics (accuracy, precision-recall, comparison to a random or constant baseline, or statistical significance tests). This omission makes it impossible to evaluate whether the reported success exceeds what could be obtained by chance or by fitting to non-secret covariates.
- [Experimental Setup (inferred from abstract)] Experimental methodology: no description is given of trace alignment, environmental shielding, power-supply decoupling, or a control experiment in which the secret is held constant while all other timing and data-flow characteristics are preserved. Without such controls it remains possible that any learned correlation arises from processor scheduling, cache effects, or external interference that happens to co-vary with the chosen secrets across the 200 acquisitions.
minor comments (2)
- [Abstract] Typos and phrasing: “McEleiece” should be “McEliece”; “two delight representatives” is unclear—consider “two representative schemes” or “two notable representatives.”
- [Abstract] The phrase “in the aftermath” is informal; a more precise transition such as “Consequently” or “Building on this observation” would improve readability.
Simulated Author's Rebuttal
We thank the referee for the constructive comments on our manuscript examining side-channel leakage in code-based post-quantum KEMs. We address each major point below and have revised the manuscript to strengthen the presentation of results and methodology.
read point-by-point responses
-
Referee: [Abstract] Abstract and experimental description: the central claim that ML models predict secret bits from 200 traces is presented without any quantitative performance metrics (accuracy, precision-recall, comparison to a random or constant baseline, or statistical significance tests). This omission makes it impossible to evaluate whether the reported success exceeds what could be obtained by chance or by fitting to non-secret covariates.
Authors: We agree that the abstract does not contain the requested quantitative metrics, making it difficult to assess the strength of the ML predictions. The manuscript demonstrates that models trained on 200 traces can recover secret bits, but specific accuracy figures, baseline comparisons, and significance tests were not included in the abstract or highlighted in the results. We have revised the abstract and added a dedicated subsection in the experimental results to report accuracy, precision-recall values, comparison against random and constant baselines, and statistical significance tests. revision: yes
-
Referee: [Experimental Setup (inferred from abstract)] Experimental methodology: no description is given of trace alignment, environmental shielding, power-supply decoupling, or a control experiment in which the secret is held constant while all other timing and data-flow characteristics are preserved. Without such controls it remains possible that any learned correlation arises from processor scheduling, cache effects, or external interference that happens to co-vary with the chosen secrets across the 200 acquisitions.
Authors: The referee is correct that the abstract provides no details on these controls, and the current manuscript text does not explicitly describe trace alignment, shielding, decoupling, or a fixed-secret control experiment. This leaves open the possibility of confounding factors. We have expanded the experimental setup section to include descriptions of trace alignment, environmental controls, power decoupling, and results from a control experiment with constant secrets to confirm that the observed leakage correlates with the secret values rather than scheduling or interference artifacts. revision: yes
Circularity Check
No circularity: claims rest on direct experimental observations
full rationale
The paper reports an empirical side-channel experiment on McEliece and BIKE decapsulation using SPA and ML models trained on 200 power traces. The abstract and described results assert observed correlations and successful bit predictions without any mathematical derivation chain, equations, fitted parameters renamed as predictions, or self-citations that bear the central load. No self-definitional steps, ansatzes smuggled via prior work, or uniqueness theorems appear; the claims are grounded in the reported measurements themselves rather than reducing to inputs by construction. This is a standard experimental reporting structure with no detectable circularity.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.