Harvest Now, Decrypt Later - Practical Attacks on Post Quantum Cryptography Implementations

The speaker argues that the push to deploy NIST's lattice-based post-quantum standards, ML-KEM and ML-DSA, is opening gaps for ordinary implementation bugs. He says the math is sound, but the code is new, written under migration deadlines, and often lightly audited.

The talk covers three attack classes. First, length-handling mistakes at the deserialization boundary can overflow a stack buffer during a hybrid TLS 1.3 key exchange, which he presents as a route to code execution before any cryptography runs. Second, constant-time C code that uses a branchless bit test was turned into a secret-dependent branch by Clang optimizations, creating a chosen-ciphertext oracle that leaks partial key material over a local network. Third, on a Cortex-M4 target, a voltage glitch that cuts short coefficient sampling during ML-DSA signing leaks the secret vector, demonstrated with a low-cost ChipWhisperer.

He argues that hybrid classical-plus-PQC helps against some of these bugs and not others. Practical defenses include memory-safe parsing and fuzzing, constant-time measurement and verification, and verified implementations. The talk ends with a live run of LatticeScope, an open-source timing-leak detector and structure-aware fuzzer, which flags planted bugs and then runs against a real implementation.