Side-channel attacks infer sensitive data from unintended signals such as timing, power use, or electromagnetic emissions, bypassing logical defenses.
Search across headline titles and summaries.
Background for this topic.
Side-channel attacks infer secrets from indirect physical or behavioral signals produced while a system operates, rather than from the intended output alone. Useful signals can include execution time, CPU-cache behavior, power use, electromagnetic emissions, or sound. In practice, attackers may measure many operations and use statistical analysis to recover cryptographic keys or distinguish sensitive data, especially when they can run code near a target or obtain physical access to a device.
The main concern is unintended information leakage from cryptographic libraries, processors, smart cards, mobile and embedded devices, and shared computing environments. Risk reduction includes constant-time implementations, masking or blinding that makes intermediate values less useful, limiting co-residency and access to high-resolution measurements, and shielding or filtering hardware where appropriate. Security testing should measure actual leakage rather than assume encryption alone prevents it; vulnerability management should also account for affected processor designs, libraries, and device models. Exposure and feasible attacker access determine whether a side channel is a practical threat.
A team has found that the Crystals-Kyber encryption algorithm is open to side-channel attacks, under certain implementations.
A group of researchers has revealed what it says is a vulnerability in a specific implementation of CRYSTALS-Kyber, one of the encryption algorithms chosen by the U.S. government as quantum-resistant last year