A second look at “AI broke Kyber” headlines
Recent coverage of an academic paper caused a stir with claims that AI had “cracked” Kyber, a NIST-recommended post-quantum encryption algorithm that Cloudflare has deployed worldwide. The reality is far less dramatic: Kyber is not broken, and the underlying technique—applying machine learning to side-channel analysis—is not new. The paper itself is solid work; the press coverage around it is not.
To clarify what actually happened, we need to separate three things: how cryptography gets broken, what side-channel attacks really are, and where machine learning fits into that picture.
Breaking cryptography head-on is rare
When people imagine breaking encryption, they picture mathematicians cracking intricate code by finding structural weaknesses. That did happen famously with the Enigma machine in World War II. But for modern, well-established algorithms, head-on breaks are exceedingly rare. RC4, designed in 1987, was the last catastrophic cipher failure. AES, from 1998, remains effectively unscathed. SHA-1, designed in 1995, was the last major hash break; SHA-2 from 2001 remains untouched in practice.
When you cannot break the math, you look for leaks elsewhere.
Side channels: unintended information leaks
A side-channel attack exploits physical or behavioral side effects of a computation. Consider a gate secured by a numeric keypad. Some buttons are visibly more worn than others, revealing which digits are in the PIN, though not their order. That worn keypad is a side channel—the security mechanism leaks information through a physical side effect.
Side channels come in many forms. Keyboard typing sounds can leak what you write, if someone is listening. Which side channel matters depends entirely on the threat model.
Timing: the remote classic
For software implementations, the most notorious side channel is runtime. A naive RSA signature computation with the square-and-multiply method includes a multiplication step only when the current key bit is 1. The runtime therefore depends on the secret key. Even worse, naive modular reduction runs slower when intermediate values exceed the modulus, allowing an attacker to send chosen messages and recover the key bit by bit—an attack that is surprisingly practical in real networks.
The standard defense is constant-time implementation: restructure the code so that all operations are always performed, regardless of secret values. This eliminates almost all remote timing attacks in practice.
Power: the physical leak
Power analysis is a different story. An oscilloscope attached to a smartcard during an RSA signature can reveal the private key directly from the power trace—the peaks and valleys of current draw correspond to key bits. Even constant-time implementations leak, because hardware gates that switch consume more power than idle gates. Computing 127 + 64 requires more energy than 64 + 64, thanks to more bit transitions.
The common countermeasure is masking: split secret values into random shares, do the bulk of the computation on the shuffled shares, and recombine at the end. For RSA, one generates a random r and computes md+r (mod n) and mr (mod n) separately, then derives md (mod n) from those intermediates. Masking does not make attacks impossible; it forces the attacker to collect more traces to cut through the added noise. More shares mean better resistance but also higher implementation cost.
The hardest part of power analysis is estimating how much secret information actually leaks and extracting it from noisy traces. That is where machine learning comes in.
Machine learning in side-channel analysis
Machine learning, including deep learning, extracts patterns from data—here, recovering secret bits from power traces. The dominant approach in side-channel work is supervised learning, with two phases. First, training: a model learns from labeled traces collected from a device where the key is known. Second, testing: given new traces from a target device with an unknown key, the trained model outputs the key. This is called a profiling attack.
The threat model may seem odd—access to a similar device—but it is practical. Attackers often control a clone of the target hardware.
Profiling attacks are not new. Template attacks appeared in 2002. Various machine learning methods have been used since roughly 2010 with good results across multiple targets. The real breakthrough came in 2016, when the side-channel community adopted deep learning. It greatly improved the effectiveness of power attacks against both symmetric and public-key cryptography, even against masked and otherwise protected implementations. Deep learning does not magically find a key; it gets much better at extracting the leaked bits from fewer traces.
These attacks have limits. Careful countermeasures still raise the bar. Tuning a successful model is genuinely difficult—often requiring weeks on powerful clusters. Interestingly, researchers in this field want even more powerful attacks: stronger attacks give security evaluators better estimates of real-world leakage, and provide insight into why attacks succeed or fail, which in turn guides more cost-effective countermeasures. Machine learning's future in side-channel analysis is bright for evaluators, but we remain far from breaking most real-world targets.
Kyber and post-quantum key agreement
Kyber is a post-quantum key encapsulation mechanism (KEM), selected by NIST for standardization after a six-year global competition. A KEM establishes a shared secret between two parties who have not previously communicated—the same job that Diffie-Hellman (e.g., X25519) does, but with different mechanics.
The protocol works like this. The client generates an ephemeral keypair, sending the public key to the server. The server encapsulates a random shared key with that public key, giving it a ciphertext that hides the shared key, which it sends back. The client decapsulates the shared key from the ciphertext using its private key.
Post-quantum key agreement matters because a present-day attacker can store encrypted traffic and break the key agreement later, once a sufficiently powerful quantum computer exists—recovering the shared key and all traffic encrypted under it. That is why Cloudflare has already deployed Kyber across its entire network.
What the research actually demonstrated is that machine learning can help mount a power side-channel attack on a masked software implementation of Kyber. This is a legitimate and useful contribution to the long-running field of side-channel analysis. It does not mean the Kyber algorithm is broken, any more than a worn keypad means the locking mechanism has a design flaw. Side-channel attacks are about implementation security, not mathematical foundations. News headlines claiming that AI broke a NIST-recommended post-quantum algorithm conflate the two. Kyber stands—as do the ongoing efforts to harder its implementations against side-channel leakage, with machine learning as a powerful ally for defenders as much as attackers.
The DNG paper in detail
The DNG paper describes a power side-channel attack against the authors' own masked implementation of Kyber using six shares. The target is the decapsulation step, specifically the re-encryption phase where a shared key is verified by re-encapsulating it and comparing against the original ciphertext. This requires converting the 256-bit secret into a polynomial whose coefficients are either (q+1)/2 or 0, depending on whether each bit is set.
The conversion is a classic source of leakage. The natural arithmetic sharing used for polynomials doesn't match the boolean sharing used for the secret, forcing an implementation that processes bits individually. The code they attack handles two shares in a loop:
For each bit, a mask is generated — 0xffff for a set bit, otherwise 0 — and used to conditionally add (q+1)/2 to a polynomial share. Processing a 1 consumes slightly more power than processing a 0, creating an observable difference. This weakness was flagged as early as 2016 and explicitly called out as a risk for masked Kyber in 2020. One mitigation is processing multiple bits simultaneously; NIST's PQC seminar from April 2023 covers the current state of the art. For now, it's enough to note that the paper targets a known-weak construction rather than demonstrating a fundamentally new break.
The authors' contribution is not a novel attack vector but rather two improvements in execution: a different neural network training strategy, and a way to combine multiple traces by rotating the ciphertext.
Measured effectiveness
Testing was done on a ChipWhisperer-Lite board with a Cortex M4 CPU downclocked to 24 MHz, sampling power at the same rate with 10-bit precision. To train the neural networks, 150,000 power traces were collected from decapsulations with known shared keys, all using the same KEM keypair. This is an unusual scenario for real deployments — key agreement KEMs are typically ephemeral — but long-term keypairs do exist for authentication, HPKE, and ECH.
Training is a particular burden. Different devices, even from the same manufacturer, can produce substantially different power traces for identical code. The authors' headline technique is progressive: they train a network to attack a six-share implementation by starting with one trained for five shares, which itself starts from a four-share model, and so on. This requires collecting one-fifth of the 150,000 traces from each of the five- and six-share (and intermediate) variants — a setup that presumes an attacker can switch mask counts on demand, which is unlikely in any deployed device.
With those assumptions granted, the results are modest. Recovering the shared key from a single trace of a two-share decapsulation succeeds with probability 0.12%. Single-trace results for more shares aren't reported. Multiple traces help considerably, aided by rotating the ciphertext to reposition bits of the shared key into more favorable locations. Four rotated traces push the success rate against two shares to 78%. The six-share implementation holds at 0.5% with four traces; with 20 traces, success reaches 87%.
Practical relevance
The hardware used — a low-power microcontroller — is roughly comparable to a smart card, not to smartphones, desktops, or servers. Power analysis on faster embedded processors is far harder, requiring tens of thousands of traces and high-end oscilloscope equipment placed directly at the processor. On a server with physical access, attacking the memory bus is a more direct route. Outside niche targets like smart cards and HSMs, power side-channel attacks are generally considered impractical. When they do succeed spectacularly — as with Hertzbleed — they translate into remote timing attacks via throttling, something this work does not approach.
Even for vulnerable devices, this attack is neither unusually potent nor surprising. Masked implementations always leak; the question is how expensive extraction is for an attacker. Papers like this help manufacturers calibrate countermeasures to push costs beyond practical limits. It is one in a continuing line of power side-channel studies on Kyber, not a decisive event.
Assessment
AI is being used as a tool to handle noisy side-channel data, not to crack Kyber's mathematics. There's a fundamental distinction between a direct break of the cryptographic scheme and an attack on an implementation's physical leakage. Kyber itself remains sound, and the demonstrated attack — even with the generous assumptions about training data and hardware — doesn't change that assessment.
