PQ migration solves quantum-resistance and creates new side-channel exposure. The lattice-based algorithms (ML-KEM, ML-DSA) have many more arithmetic operations than RSA/ECDSA, more conditional branches, more polynomial-ring math — more opportunities for implementation flaws. Treat PQ libraries with the same suspicion you’d treat a new TLS implementation: ask for security audits, prefer reference implementations.
The side-channel attack landscape
Side-channel attacks recover secrets by measuring physical or computational artifacts of execution rather than breaking the algorithm directly. The classic categories:
- Timing — observe execution time of cryptographic operations to infer secret-dependent branches. The most prevalent class.
- Cache — measure CPU cache hits/misses to infer memory access patterns. Common in cloud / multi-tenant environments.
- Power analysis (DPA, SPA) — measure power consumption variations during cryptographic operation. Requires physical access to the device.
- Electromagnetic (EM) — capture EM emanations during operation. Similar to power analysis, less invasive.
- Fault injection — induce errors (clock glitching, voltage dips, laser pulses) to skip security checks.
For PQ algorithms, timing and cache attacks are the most relevant for software deployments. Power and EM matter for embedded / smart-card implementations.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.