# Post-Quantum Key Exchange and Subscriber Identity Encryption in 5G Using ML-KEM (Kyber) 1
## 4 Security and Cryptanalysis on PQC KEM: How Kyber Was Selected
### Side-Channel Attack on NIST's Third Round  
Side-channel attack is the process of extracting secret and information from the system or chip by measuring and examining the physical factors. Common side-channel analyses are timing, power, electromagnet, cold boot, correlation power, etc., when the adversary has physical access to the system computing cryptographic algorithms. These types are considered as side-channel attacks. There are several parameters or factors (NTT, sample distribution, secret key, polynomial degree, etc.) in lattice-based schemes (SIS or LWE) that can be targeted. [PERSON] et al. [30] in 2010 demonstrated a simple power attack on typical software implementation of NTRU. They implemented over a low-end device (Timoto sky) and showed the results of first- and second-order correlation power analysis (CPA) attacks. [PERSON] also proposed three countermeasures against SPA and CPA attacks on NTRU. After three years, in 2013, [PERSON] et al. [31] introduced a collision attack against [PERSON]'s proposed countermeasure that resulted in 78% efficiency. One of the parameters that is used in NTRUprime is the school-book polynomial multiplier, where the coefficient is calculated specifically. It was attacked by [PERSON] et al. [32] using vertical CPA and online temple attack. Lattice-based crytoosystems that use LWE are also vulnerable to side-channel attack. [PERSON] [33] found some leakage in NTT, which is used in almost all cryptosystems based on LWE lattices, and proposed a new side-channel attack on single decryption; this attack is also effective for mask implementation to recover individual shares and then to combine and perform a full key recovery attack. [PERSON] [34] introduced an attack that targeted the matrix and polynomial multiplication based on hardware implementation on FPGA and found vulnerabilities in the NewHope and Frodo KEM cryptosystem. In their attack, they used horizontal DPA, which resulted in full key recovery in a single trace. [PERSON] et al. [35] demonstrated a software implementation in the ARM cortex M0 process and investigated a single trace of Frodo KEM, which is a ringless cryptosystem based on LWE. Some LWE cryptostymes use error-correcting code to minimize the failure decryption probability. [PERSON] [36] used a timing attack to find error correcting and illustrate a key recovery attack on the LAC scheme, which uses error-correcting code. [PERSON] [37] showed vulnerabilities based on EM in the error correction code of round 5 and LAC, and also found a similar vulnerability in the FO transform (Fuijsaki-Okamoto), implemented in the ARM cortex process microcontroller using the public library pqm4. [PERSON] et al. [38] presented a clustering attack on Kyber and target leakage of Barette reduction in the decapsulation phase, implemented in the ARM cortex-M4 microcontroller. [PERSON] [39] investigated the impact of the failure in the chosen cipher security of a lattice-based system, used the failure boosting technique, which boosts the failure rate, and then analyzed the amount of information. [PERSON] et al. [40] described a fault attack on the round 3 NIST finalized algorithm (NewHope, Dilithium, Frodo and Kyber) and showed, misuse-nonce, result key recovery, and message attack. [PERSON] et al. [41] proposed an EM side-channel attack on the ciphertext on Kyber and also described a full key extraction through simple power analysis. Additionally, [PERSON] et al. [42] introduced a fault attack on Kyber and showed that the combination of the chosen cipher attack and fault injection can compromise and threaten implementation. [PERSON] et al. [43] discussed the security of crystal Dilithium in contrast to the combination of a classical attack and side-channel attack. The author divided the research into two parts. One concerned using the power analysis and retrieving the partial secret key, and the second concerned showing that the signature can be forged even by partial knowledge of the secret key, which can be retrieved by using power analysis. [PERSON] et al.