NEW YORK — What happened
At a hardware security symposium in September 2026, researchers demonstrated a physical side-channel attack against enterprise Hardware Security Modules (HSMs) running newly standardized post-quantum cryptography (PQC) algorithms. By capturing electromagnetic radiation emitted by the chip during decryption, the team successfully recovered private keys.
Why it matters
As organizations transition to post-quantum algorithms designed to resist future quantum computer attacks, many assume that mathematically secure algorithms guarantee physical safety. This research highlights that even mathematically sound algorithms can fail if their hardware implementation leaks information through power consumption or physical emissions.
Deep dive
The attack targeted the mathematical lattice operations used in post-quantum key encapsulation mechanisms (KEMs). As the dedicated crypto-coprocessor multiplies large matrices, subtle variations in electrical current create measurable electromagnetic signatures. By placing a specialized probe millimeters above the packaged chip and collecting thousands of trace measurements, the researchers used machine-learning models to reconstruct the secret polynomial coefficients.
Report check
Claims: Reports asserted that post-quantum encryption standards are mathematically broken. Verified: The underlying mathematics remain secure; the vulnerability lies solely in the physical hardware implementations lacking electromagnetic shielding. Verified: The attack requires physical access to the server rack and specialized probe hardware.
Open questions
Can chip manufacturers patch physical side-channel leaks via microcode updates, or will data centers require physical hardware replacements? How will hardware certification standards adapt to test post-quantum chips against physical measurement attacks?