Researchers at ETH Zurich have demonstrated a practical attack against post-quantum cryptographic algorithms currently being standardized by NIST, raising concerns about the timeline for transitioning critical infrastructure to quantum-resistant encryption. The attack exploits implementation flaws rather than mathematical weaknesses in the algorithms themselves, but the implications for real-world deployments are significant.
The Post-Quantum Migration Challenge
As quantum computers advance toward cryptographic relevance, governments and organizations worldwide are racing to adopt post-quantum cryptographic (PQC) algorithms that can withstand attacks from both classical and quantum computers. NIST finalized its first set of PQC standards in 2024, selecting algorithms including ML-KEM (formerly CRYSTALS-Kyber) and ML-DSA (formerly CRYSTALS-Dilithium) for widespread adoption.
The ETH Zurich team found that several popular open source implementations of these algorithms contain timing side-channel vulnerabilities that allow an attacker to recover secret keys by measuring how long cryptographic operations take to execute. While the algorithms themselves are mathematically sound, the code that implements them inadvertently leaks information through variable execution times.
Scope of the Problem
The researchers tested 12 widely used PQC libraries and found timing vulnerabilities in eight of them. The affected libraries are used in major open source projects including OpenSSL, BoringSSL, and liboqs, which means the vulnerabilities could potentially affect millions of servers and devices once PQC migration is complete.
Why Implementation Security Matters
The history of cryptography is filled with examples of mathematically secure algorithms being undermined by implementation flaws. The infamous Heartbleed vulnerability in OpenSSL, which exposed the private keys of millions of web servers, was an implementation bug rather than a cryptographic weakness.
“Designing a secure algorithm is only half the battle,” said Dr. Annalisa Barla, lead researcher on the project. “The transition to post-quantum cryptography gives us an opportunity to get implementation security right from the start, but only if we take it seriously.”
Impact on Migration Timelines
The findings have implications for the ambitious PQC migration timelines set by governments and industry bodies. The U.S. National Security Agency has directed that all national security systems transition to PQC by 2035, and many organizations have already begun pilot deployments.
Security experts caution that rushing the transition without ensuring implementation quality could create a false sense of security. An organization that deploys a vulnerable PQC implementation may believe its data is protected against quantum attacks while remaining vulnerable to classical side-channel attacks that are far more practical today.
Recommendations
The researchers recommend that organizations adopting PQC algorithms use only implementations that have undergone formal verification or extensive side-channel testing. They have also released an open source testing framework called PQCTimer that automates the detection of timing vulnerabilities in PQC implementations.
The NIST PQC team has acknowledged the research and stated that future updates to the PQC standards will include more detailed implementation guidance focused on side-channel resistance. Library maintainers for the affected projects have been notified and are working on patches.
The research underscores that the transition to post-quantum cryptography is not simply a matter of swapping algorithms. It requires a comprehensive approach that encompasses algorithm selection, secure implementation, rigorous testing, and ongoing monitoring, a process that will take years to complete and must be approached with both urgency and care.
