A cryptographic scheme designed to withstand the computing power of future quantum machines can still be undone by something far more mundane: the electrical signature of the chip running it. Researchers at SEALSQ presented a peer-reviewed paper at LightSec 2026, a workshop held alongside the CHES 2026 conference, detailing a new side-channel attack against ML-KEM, one of the key algorithms selected by the US National Institute of Standards and Technology for post-quantum cryptography. The finding does not undermine the mathematics behind ML-KEM, but it does expose how fragile real-world implementations can be when physical leakage is left unaddressed.
A hybrid attack that outperforms older methods
The paper, titled "Cross-information lattice attack on ML-KEM," focuses on the encoding step of key generation, a phase where sensitive data can inadvertently leave measurable traces through power consumption or electromagnetic emissions. The SEALSQ team combined profiling-based techniques, which study statistical patterns in a device's execution behavior, with lattice reduction, a mathematical technique used to simplify otherwise intractable lattice problems. Neither approach alone is new, but fusing them produced a method the researchers describe as more effective at extracting sensitive information than prior single-technique attacks. This matters because ML-KEM, like other lattice-based schemes, relies on the presumed hardness of lattice problems for its theoretical security. A hybrid attack that chips away at that margin through implementation leakage, rather than through brute mathematical force, represents a meaningfully different threat model.
Why implementation security still lags behind theory
Post-quantum cryptography has spent the better part of a decade being evaluated primarily on mathematical soundness: can an algorithm resist an attacker armed with a sufficiently powerful quantum computer? Far less attention, historically, has gone to the physical behavior of chips that run these algorithms in the field. Side-channel attacks sidestep the cryptographic problem entirely and instead watch how a device behaves while it computes, inferring secret values from power draw, timing, or electromagnetic radiation. This is particularly consequential for embedded devices, smart cards, and industrial controllers, which often remain in service for many years and cannot always receive software patches after deployment. For such hardware, security has to be engineered in from the start, not bolted on later.
Countermeasures built into the QS7001
SEALSQ says the research directly reinforces the design of its Quantum Shield QS7001 secure element, which embeds NIST-standardized post-quantum algorithms, including ML-KEM, at the hardware level. The chip incorporates hardware-level acceleration alongside dedicated defenses against simple power analysis and differential power analysis, two of the most established side-channel attack families, along with active shielding and signal-scrambling techniques intended to mask the physical signatures attackers rely on. The QS7001 is currently going through Common Criteria EAL5+ certification, one of the more demanding independent evaluation standards applied to secure hardware, which the company presents as further validation of its security architecture.
Positioning for the post-quantum transition
Carlos Moreira, SEALSQ's founder, chairman and chief executive, said that presenting peer-reviewed work at a CHES-affiliated workshop reflects the company's dual role as both product developer and contributor to the wider cryptographic research community, and that combining side-channel expertise with hardware-embedded post-quantum cryptography strengthens its ability to deliver trusted security solutions. The research extends earlier work by the company on side-channel protection for polynomial-based algorithms, part of a broader push toward crypto-agile architectures capable of adapting as standards and threat models evolve. As organizations across government and industry begin migrating toward post-quantum cryptography, the episode is a reminder that algorithmic strength and implementation security are separate battles, both of which have to be won.