💻 computer science

Simple Power Analysis on Post-Quantum Code Based Cryptosystems

This paper demonstrates that Simple Power Analysis combined with machine learning can successfully extract secret bits from the McEliece and BIKE post-quantum cryptosystems using only 200 power traces, revealing significant information leakage during the decapsulation phase.

Original authors: Konstantinos Spalas

Published 2026-05-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Konstantinos Spalas

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a high-tech, futuristic lockbox designed to keep your secrets safe, even from super-computers of the future (Quantum Computers). This paper is about a student named Konstantinos who decided to see if these "unbreakable" boxes actually have a secret backdoor, not in the math, but in the way they physically behave when they work.

Here is the story of the experiment, broken down into simple parts:

1. The "Whispering" Lockbox

The paper focuses on two specific types of futuristic locks called McEliece and BIKE. These are designed to be "Post-Quantum," meaning they are built to survive attacks from quantum computers.

Usually, people think security is all about the math. If the math is hard, the lock is safe. But Konstantinos looked at the physical side. He realized that when a computer unlocks a box, it doesn't just think; it also "sweats." It uses electricity, and that electricity creates tiny, invisible ripples in the air (electromagnetic waves) and changes how much power it draws.

Think of it like a safe-cracker listening to a safe. Even if the combination is perfect, the safe might make a tiny click or a whir when the right number is turned. That sound is a "leak." In the digital world, this leak is called Simple Power Analysis (SPA).

2. The "Low-Tech" Detective Kit

You might think you need a million-dollar lab to catch these leaks. Konstantinos proved you don't. He built a "detective kit" using cheap, off-the-shelf parts, similar to what a hobbyist might buy:

The Target: A Raspberry Pi 3 (a tiny, cheap computer) acting as the lockbox.
The Sensor: A tiny resistor (like a speed bump for electricity) to measure how much power the computer uses.
The Amplifier: A small device to make the tiny electrical signals loud enough to hear.
The Recorder: A Raspberry Pi Pico (another tiny computer) to write down the data.

It's like using a stethoscope and a notebook instead of a super-microscope to listen to a heartbeat.

3. The "Heartbeat" of the Secret

The experiment involved opening the lockbox (a process called decapsulation) to generate a secret key. As the computer did this, Konstantinos recorded the "heartbeat" (the power usage) of the machine.

He then asked a simple question: "Does the heartbeat change depending on the secret number being processed?"

To answer this, he used a statistical tool (a correlation coefficient) to see if the power spikes matched the secret bits (0s and 1s).

The Result: Yes! The heartbeat changed. When the computer processed a "1," the power spike was different than when it processed a "0."
The Proof: He found that the power traces and the secret bits were linked with a strength greater than 0.1 (a threshold that experts agree means "there is a leak").

4. Teaching a Computer to Read the Mind

The most interesting part was what happened next. Konstantinos didn't just look at the data; he taught a computer (using Machine Learning) to predict the secret bits based only on the power traces.

Imagine you have a bag of 200 secret notes. You give a robot the sound of the computer working, and ask it to guess the notes.

The Outcome: The robot got it right more often than if it had just guessed randomly.
The Specifics: The robot was particularly good at guessing the "1" bits because those caused bigger power spikes (like a louder heartbeat).
The Score: The system was able to predict the secret information with a success rate (F1 score) consistently above 0.65, which is considered a significant leak in the world of cryptography.

5. The Conclusion

The paper concludes that even though these Post-Quantum locks are mathematically strong, their physical implementation on cheap hardware is "leaky."

The Bad News: If you use these systems on simple devices without extra protection, a thief with a cheap kit could potentially steal your secret key just by listening to the power usage.
The Future: The paper suggests that to fix this, engineers need to add "noise" or "masks" to hide the true heartbeat of the computer. It also notes that another system called HQC wasn't tested yet because it wasn't available in the software library used, leaving that as a job for future researchers.

In short: The paper shows that even the most advanced digital locks can be cracked by listening to their "whispers" if you know how to listen, and you don't need a supercomputer to do it—just a few dollars worth of electronics.

Technical Summary: Simple Power Analysis on Post-Quantum Code-Based Cryptosystems

Problem Statement
Post-quantum cryptography (PQC) is increasingly being adopted to replace current cryptographic schemes due to their resilience against quantum computer attacks. Among these, code-based cryptosystems like McEliece and Bit Flip Key Encapsulation (BIKE) are prominent candidates. While these algorithms are designed to withstand structural attacks (such as Information Set Decoding) through appropriate key sizing, their physical implementations may remain vulnerable. This paper addresses the risk that unintended information leakage during the execution of these algorithms—specifically during the decapsulation phase where a shared secret key is generated—could be exploited via Side-Channel Attacks (SCA). The study focuses on Simple Power Analysis (SPA), a class of SCA that exploits observable characteristics like power consumption and electromagnetic emissions to infer sensitive internal states, potentially reducing the complexity of algebraic cryptanalysis.

Methodology
The research employs a low-cost experimental setup to evaluate whether software implementations of McEliece and BIKE (from the Open Quantum Safe library, NIST security level-3) leak information via power consumption. The experimental apparatus consists of:

Device Under Test (DUT): A Raspberry Pi 3 executing the cryptographic operations.
Sensing Mechanism: A shunt resistor to observe voltage drops during operations, amplified by an operational amplifier (op-amp).
Data Acquisition: A Raspberry Pi Pico microcontroller used to translate and store the amplified voltage variations.
Software: A Python wrapper for the OQS library to manage the cryptographic processes.

The methodology involves capturing power traces during the decapsulation phase. The study utilizes a statistical approach based on the null hypothesis that "software implementations of code-based post-quantum cryptography do not leak information." To test this, the authors calculate the Pearson correlation coefficient ( $\rho$ ) between the measured voltage drops (representing power consumption) and the Hamming weight of the last byte of the intentionally stored shared secret key. A correlation threshold of $\rho > 0.1$ is used as the benchmark for significant leakage, based on existing literature. Furthermore, the study employs Machine Learning (ML) classifiers (SVM, kNN, Logistic Regression, Random Forest) to predict secret bits from the shared session key using only 200 collected power traces.

Key Results
The experimental evaluation yielded the following findings:

Correlation Analysis: The null hypothesis was rejected. Both McEliece and BIKE implementations demonstrated correlation coefficients exceeding the 0.1 threshold. Specifically, voltage spikes during the McEliece decapsulation phase aligned with high variations in $\rho$ , and BIKE traces showed correlations exceeding the threshold, indicating a measurable relationship between power consumption and the ephemeral key.
Machine Learning Prediction: Using only 200 traces, ML models successfully predicted secret bits with accuracy rates ranging from 0.60 to 0.63.
- For McEliece, the F1 score for predicting bit '1' consistently exceeded 0.65 across models (e.g., SVM-RBF achieved 0.65, kNN achieved 0.67).
- For BIKE, similar trends were observed, with Random Forest achieving an F1 score of 0.65 for bit '1'.
- The results indicate that bit '1' is more easily predicted than bit '0', likely due to higher voltage spikes associated with the logical '1' state.
Leakage Characteristics: The McEliece system was found to leak scalable information, with F1 scores consistently above 0.65.

Significance and Claims
The paper claims that even with low-cost, accessible equipment, significant information leakage can be detected in post-quantum code-based cryptosystems. The study demonstrates that the correlation between electromagnetic emissions and secret values is strong enough to allow for the prediction of shared session key bits using a minimal dataset (200 traces). The authors assert that these findings highlight the necessity of evaluating and mitigating side-channel leakage, particularly for embedded and resource-constrained platforms where countermeasures may be limited.

Future Work and Limitations
The authors note that the current setup, while realistic, involves trade-offs such as low sampling resolution and noise. They suggest that future work should focus on evaluating masking countermeasures using similar low-cost SPA setups, as performing such attacks would be challenging yet necessary for validation. Additionally, the paper identifies the Hamming Quasi-Cyclic (HQC) KEM as a promising subject for future study, noting its exclusion from the current experiment because it was not part of the OQS library at the time of the research.

1. The "Whispering" Lockbox

2. The "Low-Tech" Detective Kit

3. The "Heartbeat" of the Secret

4. Teaching a Computer to Read the Mind

5. The Conclusion

More like this