A cryptographic algorithm chosen by the United States government to secure data against future quantum computers has a weak point in how it generates keys - and researchers at SEALSQ Corp (NASDAQ:LAES) have mapped it out in detail. The company's research team presented a technical paper on side-channel attacks targeting ML-KEM key generation at LightSec 2026, held Saturday in Antalya, Turkey, according to a company statement. The findings arrive as governments and industries race to replace existing encryption before quantum computers become powerful enough to break it.
Why ML-KEM Matters
ML-KEM, short for Module-Lattice-Based Key Encapsulation Mechanism, is one of the algorithms the U.S. National Institute of Standards and Technology (NIST) has standardized for post-quantum cryptography. It is designed to secure the exchange of encryption keys in a way that resists attacks from both classical and quantum computers, relying on the mathematical difficulty of problems involving structured lattices rather than the factoring and discrete-logarithm problems that underpin today's widely used RSA and elliptic-curve systems. As organizations begin migrating critical infrastructure, financial systems, and communications toward these new standards, the security of their actual implementations - not just their theoretical mathematics - has become a pressing concern.
That distinction is at the heart of SEALSQ's paper, titled "Cross-information lattice attack on ML-KEM." The research does not challenge the underlying mathematics of ML-KEM but instead examines vulnerabilities in the encoding step of its key generation process, where real-world hardware can inadvertently leak information.
How Side-Channel Attacks Work
Side-channel attacks do not try to break encryption through brute computation. Instead, they exploit physical traces left behind by a device as it performs cryptographic operations - fluctuations in power consumption, electromagnetic emissions, or subtle timing differences. By measuring these signals during key generation, an attacker with physical or close proximity access to a chip can potentially reconstruct secret information without ever defeating the cryptographic algorithm itself.
SEALSQ's research combines profiling-based techniques, which build statistical models of a device's physical behavior, with lattice reduction methods that help narrow down possible key values from leaked data. The paper also proposes countermeasures intended to harden ML-KEM implementations against this type of exploitation, a contribution aimed at chipmakers and developers building post-quantum systems into physical hardware.
A Workshop Tied to a Major Cryptography Conference
LightSec 2026 is an affiliated event of CHES 2026, the Conference on Cryptographic Hardware and Embedded Systems, running from October 11 to 15, 2026. CHES is among the most established venues for research into the practical, physical security of cryptographic systems - as distinct from their theoretical soundness - making it a natural forum for work on implementation-level vulnerabilities like side-channel leakage.
"Presenting peer-reviewed work on ML-KEM implementation security at a CHES-affiliated workshop underscores our dual role as both product innovators and contributors to the global cryptographic research community," said Carlos Moreira, founder, chairman, and CEO of SEALSQ.
Hardware Implications for Resource-Constrained Devices
The vulnerabilities described in the paper are especially relevant for embedded and resource-constrained devices, such as authentication tokens, industrial sensors, and connected hardware, where cryptographic operations often run on limited processing power and are physically accessible to potential attackers. SEALSQ's own Quantum Shield QS7001, a secure element built on a RISC-V architecture, embeds the NIST-standardized ML-KEM and ML-DSA algorithms directly in hardware and includes countermeasures against side-channel attacks. The product is currently undergoing Common Criteria EAL5+ certification, a rigorous international security evaluation standard used for high-assurance hardware.
SEALSQ positions itself across semiconductors and post-quantum technology, with applications spanning authentication, smart energy, healthcare, defense, IT infrastructure, automotive systems, and industrial automation. As the transition to quantum-resistant cryptography accelerates across these sectors, research exposing and addressing implementation flaws - rather than theoretical ones - is likely to shape how securely that transition actually unfolds.