SEALSQ presented peer-reviewed research at LightSec 2026 on a side-channel attack targeting the encoding step of ML-KEM key generation. The research combines side-channel analysis with lattice reduction and proposes countermeasures to strengthen post-quantum cryptographic implementations against physical attacks.
Key takeaways
- Research focus: side-channel security of ML-KEM key generation.
- Attack approach: profiling-based side-channel techniques combined with lattice reduction.
- Practical outcome: the research also examines countermeasures to improve ML-KEM implementation robustness.
- Industry relevance: quantum-resistant algorithms need protection against physical implementation attacks, not only mathematical cryptanalysis.
- SEALSQ application: this implementation-security expertise complements the hardware security approach used in SEALSQ’s Quantum Shield QS7001.
What did SEALSQ present at LightSec 2026?
SEALSQ presented peer-reviewed research on the implementation security of ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism standardized by NIST in FIPS 203.
The paper, titled “Cross-information lattice attack on ML-KEM,” investigates a side-channel attack targeting the encoding step during ML-KEM key generation.
The research was presented at LightSec 2026, the 7th International Workshop on Lightweight Cryptography for Security & Privacy, held on October 11, 2026 in Antalya, Turkey, as an affiliated event of CHES 2026.
Rather than challenging the mathematical foundations of ML-KEM itself, the work examines an equally important question:
What happens when a mathematically secure post-quantum algorithm is implemented and executed on physical hardware?
What is ML-KEM and why is it important for post-quantum security?
ML-KEM, or Module-Lattice-Based Key-Encapsulation Mechanism, is a post-quantum cryptographic mechanism standardized by NIST in FIPS 203 for establishing shared secrets.
Previously known as CRYSTALS-Kyber during the NIST standardization process, ML-KEM is based on lattice mathematics and is designed to resist attacks from both classical and future quantum computers.
Its standardization represents an important step toward replacing cryptographic mechanisms that could eventually become vulnerable to sufficiently powerful quantum computers.
But choosing a quantum-resistant algorithm is only one part of the transition.
Once ML-KEM is implemented in software or semiconductor hardware, the implementation itself must also resist attacks.
What is the ML-KEM attack presented by SEALSQ?
The research presented at LightSec 2026 targets the encoding step of ML-KEM key generation using information obtained through side-channel analysis.
The proposed method combines profiling-based side-channel techniques with lattice reduction.
Side-channel observations can reveal information about operations taking place during cryptographic execution. The research investigates how this information can be combined with the mathematical structure of lattice cryptography to recover sensitive information more effectively than using the individual techniques alone.
The work therefore illustrates a key distinction in post-quantum cybersecurity:
Breaking an implementation is not the same as breaking the underlying cryptographic algorithm.
The research does not mean that ML-KEM itself has been mathematically broken. It demonstrates why implementations of ML-KEM must also be designed to withstand physical attacks.
What are side-channel attacks?
A side-channel attack exploits information produced by the physical execution of cryptographic operations rather than directly attacking the underlying cryptographic mathematics.
Depending on the implementation and attack scenario, observable information can include:
- power consumption;
- electromagnetic emissions;
- timing behavior;
- patterns generated during specific cryptographic operations.
This information can potentially provide clues about sensitive operations or data being processed by a device.
For post-quantum cryptography, this means that quantum resistance alone does not guarantee implementation security.
Why does ML-KEM need hardware-level protection?
ML-KEM may be mathematically resistant to known classical and quantum cryptanalysis, but the algorithm ultimately runs on physical hardware.
This creates several complementary security requirements:
| Security layer | What it protects against |
|---|---|
| Post-quantum algorithm security | Mathematical cryptanalysis by classical and quantum computers |
| Implementation security | Leakage or vulnerabilities introduced during algorithm execution |
| Side-channel resistance | Exploitation of power, timing, electromagnetic or related observations |
| Hardware security | Physical attacks against keys and cryptographic operations |
For applications such as automotive systems, industrial equipment, critical infrastructure and other long-lifecycle connected devices, these layers need to work together.
What countermeasures does the research explore?
The research does not stop at demonstrating an attack. It also presents practical countermeasures intended to improve the robustness of ML-KEM implementations.
Analyzing attacks at the implementation level enables researchers and semiconductor designers to identify where information may leak during cryptographic operations and determine where additional protections are required.
This attack-and-countermeasure approach is particularly important as post-quantum cryptography moves from algorithm standardization to deployment in commercial products.
The objective is no longer simply to answer:
“Is the algorithm quantum-resistant?”
It must also answer:
“Is the implementation resilient when the algorithm executes on a real device?”
How does this research relate to SEALSQ’s QS7001?
SEALSQ’s implementation-security research directly complements the development of the Quantum Shield QS7001 secure element, which combines a hardware Root of Trust with the NIST-standardized post-quantum algorithms ML-KEM (FIPS 203) and ML-DSA (FIPS 204) alongside classical cryptography.
The connection between research and product development is particularly relevant to physical security. QS7001 V1 has successfully completed the technical evaluation phase of its Common Criteria EAL5+ certification, passing all physical and functional security tests performed by SERMA Safety & Security. The evaluation covers resistance to physical and side-channel attacks, including fault injection.
The certification process has now entered its final phase, which includes site audits before the evaluation report is submitted to ANSSI for formal certificate issuance.
Why does implementation security matter for the post-quantum transition?
The migration to post-quantum cryptography is not simply a replacement of algorithms. It is also a hardware and implementation-security challenge.
Organizations preparing for the post-quantum transition need to consider three questions:
- Are the cryptographic algorithms quantum-resistant?
- Are those algorithms securely implemented?
- Can the hardware protect keys and cryptographic operations against physical attacks?
These considerations become particularly important for long-lifecycle products such as industrial infrastructure, automotive platforms, connected equipment and other systems expected to remain operational as the quantum threat evolves.
By researching both attacks and countermeasures, SEALSQ aims to connect post-quantum cryptographic research with secure semiconductor implementation.
Conclusion: Post-quantum security must extend from algorithms to silicon
NIST standardization has answered an essential question about which cryptographic algorithms can form the foundation of the post-quantum transition.
The next challenge is ensuring those algorithms remain secure when implemented in real devices.
Research into ML-KEM side-channel attacks and countermeasures helps bridge the gap between mathematical post-quantum security and practical hardware security.
For SEALSQ, this connection between cryptographic research, implementation security and semiconductor engineering is central to developing hardware designed for the post-quantum era.
Post-quantum security does not stop at choosing a quantum-resistant algorithm. It must extend all the way to its implementation in silicon.