Researchers at MIT and Stanford University have discovered a novel class of side-channel attacks that can extract cryptographic keys from processors by analyzing fluctuations in power consumption at the transistor level. The attack, which the researchers have named “VoltLeech,” works against a wide range of modern CPUs and could undermine encryption implementations previously considered secure.
The Technical Breakthrough
VoltLeech exploits subtle variations in voltage regulation that occur when a processor executes cryptographic operations. By placing a malicious sensor on the same power rail as the target processor, an attacker can measure these variations and use statistical analysis to reconstruct the cryptographic keys being processed.
What makes VoltLeech particularly concerning is that it can be executed remotely in cloud computing environments. In multi-tenant cloud setups where virtual machines share physical hardware, a malicious VM on the same server could potentially extract keys from a neighboring VM without any direct interaction.
Proof of Concept Results
The research team demonstrated successful key extraction against AES-256 and RSA-4096 implementations running on Intel, AMD, and ARM processors. In laboratory conditions, VoltLeech could recover a full AES-256 key in approximately 14 minutes of observation and an RSA-4096 key in under two hours.
“The fundamental issue is that cryptographic operations create deterministic patterns in power consumption that cannot be entirely eliminated through software countermeasures alone,” said Dr. Sarah Chen, lead researcher on the project.
Implications for Cloud Security
The discovery has significant implications for cloud service providers, which rely on hardware isolation to protect customer workloads. While existing side-channel attacks like Spectre and Meltdown targeted processor caches, VoltLeech operates at the electrical level, making it harder to detect and mitigate through software patches alone.
Amazon Web Services, Microsoft Azure, and Google Cloud have all acknowledged the research and stated that they are evaluating the potential impact on their platforms. All three providers emphasized that their security architectures include multiple layers of protection beyond hardware isolation.
Mitigations and Next Steps
The researchers have proposed several countermeasures, including voltage noise injection circuits that add random fluctuations to mask cryptographic operations, and workload-aware scheduling algorithms that prevent sensitive computations from sharing power domains with untrusted code.
Hardware Fixes Required
Intel and AMD have both confirmed that they are working on hardware-level mitigations for future processor generations. However, experts warn that existing deployed hardware will remain vulnerable, and software-only mitigations may impose performance penalties of 5 to 15 percent on cryptographic operations.
The full research paper will be presented at the USENIX Security Symposium in August 2026. The researchers have followed responsible disclosure practices, providing 90 days of advance notice to affected vendors before publication.
