ERI: physical layer side channel assessment and lightweight countermeasures for embedded post quantum cryptography

The National Science Foundation Division of Electrical, Communications and Cyber Systems awarded Florida Institute of Technology Inc. $199,865 on July 1, 2026, under the Engineering program (CFDA 47.041) to assess physical layer side-channel vulnerabilities in post-quantum cryptographic implementations on embedded microcontrollers and to develop lightweight countermeasures that operate within energy, memory, and processing constraints of real-world resource-constrained devices.

The project measures side-channel leakage—power consumption variations and electromagnetic emissions that can reveal secret keys to attackers with physical or close-proximity access—in NIST-standardized post-quantum cryptographic algorithms deployed on representative embedded systems. Deliverables include open datasets, analysis tools, and practical defense techniques applicable to smart meters, industrial sensors, medical monitors, and other connected devices. The work also encompasses educational activities: hands-on laboratory modules, student research projects, senior design projects, and IEEE Student Branch outreach at Florida Institute of Technology to build workforce capacity in hardware security and quantum-resistant cryptography.

Performance occurs in Melbourne, Florida, with a period of performance from July 1, 2026, through June 30, 2028. The award is classified as a Project Grant.

Abstract

Public-key encryption and digital signatures protect financial transactions, power-grid equipment, medical devices, industrial sensors, and many other systems that society depends on. Future quantum computers could break the mathematical foundations of many widely used public-key systems, which has motivated the standardization of new post-quantum cryptographic algorithms. However, mathematical security alone is not enough for secure deployment. When cryptographic algorithms run on small, low-cost microcontrollers used in smart meters, industrial sensors, medical monitors, and other connected devices, they can leak secret information through tiny variations in power consumption or electromagnetic emissions. An attacker with physical or close-proximity access may exploit these unintentional signals to recover secret keys without breaking the underlying cryptographic mathematics. This project addresses that implementation-security GAP by measuring physical side-channel leakage in post-quantum cryptography on representative embedded devices and by developing practical defenses that fit within the energy, memory, and processing constraints of real-world systems. The research will generate open datasets, analysis tools, and countermeasure techniques to support the secure deployment of post-quantum cryptography in resource-constrained environments. The project will also train students in hardware security, embedded cryptography, and side-channel evaluation, strengthening the workforce needed for the nation?s transition to quantum-resistant technologies. Educational activities include hands-on laboratory modules, student research projects, senior design projects, and outreach through the ieee student branch at florida institute of technology. This project establishes empirical baselines for physical side-channel leakage in NIST-standardized post-quantum cryptographic algorithms on embedded processors and develops lightweight compiler-based countermeasures suitable for resource-constrained deployment. The research is organized into two thrusts. The first thrust characterizes power and electromagnetic leakage during the execution of ML-KEM, standardized as fips 203, and ML-DSA, standardized as fips 204, on arm cortex-m-class microcontrollers. The evaluation will use established side-channel methods, including correlation power analysis and test vector leakage assessment, and will focus on algorithm-specific operations such as the number theoretic transform, polynomial multiplication, noise sampling, and signature rejection logic. The second thrust designs and evaluates compiler-based countermeasures that reduce implementation-level leakage by randomizing execution timing and instruction ordering where algorithmic dependencies permit. These transformations will be implemented as reusable low level virtual machine compiler passes and evaluated against unprotected and partially protected baselines. Security effectiveness will be assessed using trace-based leakage measurements, key-recovery experiments, leakage-detection statistics, and performance, memory, and energy overheads. Cross-platform applicability will be supported by separating architecture-independent analysis and transformation logic from board-specific measurement code, with targeted validation on embedded platforms beyond the primary testbed where feasible. The project will release measurement code, compiler passes, curated datasets, and analysis scripts as open-source artifacts with persistent identifiers to enable reproducible research and community benchmarking. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are not planned for this award.