Shandong University's Chen and Li Recover 16 Private-Key-Dependent Bits From BIKE's BGF Decoder by Deep-Learning Power Analysis at 95.68 Percent, Cybersecurity 9:215, 16 September 2026
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · September 24, 2026.
On September 16, 2026, the open-access journal Cybersecurity published "A deep learning based side-channel attack on BIKE" by Geng Chen, Yanbin Li, Shilin Sun, Zongyue Wang, Chunpeng Ge, Fusheng Wu and Qiuliang Xu, a team led from Shandong University with collaborators at Open Security Research and the Guizhou University of Finance and Economics. The paper reports that the fourth-round reference implementation of BIKE, a code-based key encapsulation mechanism, leaks a private-key-dependent 16-bit sequence through its power consumption while it decodes, and that a convolutional recurrent network trained with connectionist temporal classification reads that sequence out of a single 8,333-point trace with 99.69 percent bit accuracy and 95.68 percent perfect-sequence recovery on 1,200 held-out traces.
For a defense reader the item matters for a reason that has little to do with BIKE's own prospects. NIST closed its fourth round in March 2025 by selecting HQC as the one additional key-establishment scheme it will standardize, and BIKE was left out. The paper is therefore a side-channel attack on a scheme few program offices will field. What it delivers is a method: an alignment-free way to read secret-dependent branch decisions out of long, jittery power traces, exercised on a post-quantum decoder whose structure made that hard. The question a buyer should ask is whether the method travels to the code they will actually deploy.
What Chen, Li and colleagues measured on an ARM Cortex-M4 board: 21,200 traces, a 16-bit branch sequence, and 95.68 percent perfect recovery
BIKE builds its key encapsulation on quasi-cyclic moderate-density parity-check codes, and its version 5.2 specification of October 2024 recommends the Black-Gray-Flip decoder, known as BGF, because it runs a fixed number of iterations and keeps the decoding-failure rate low. Inside each iteration a routine the reference code calls ctr counts, for every bit position, how many parity-check equations are unsatisfied. The authors show that sixteen syndrome samples form a private-key-dependent sequence: each sample, `s[(h_compact_col[i] + position) mod r]`, controls whether the counter is incremented, so the pattern of taken and skipped counter-increment branches carries information about the key.
The physical signature is plain in the paper's measurements. A taken counter-increment branch occupies about 670 sample points on the oscilloscope; a skipped branch occupies about 200. Sixteen branch outcomes of unequal length, separated by silent stretches whose position shifts with the decoding state, mean that a fixed capture window never lines up the same way twice. Earlier profiling attacks cut a trace into fixed frames and classify each frame, and that pipeline breaks here. The team's answer is borrowed from speech recognition: treat the whole trace as an input sentence and the 16 bits as an output sentence, and let connectionist temporal classification, CTC, learn the alignment on its own through a blank symbol and a sum over every admissible path.
The experiment is described in enough detail to be reproduced. An ARM Cortex-M4 development board ran an unprotected copy of the reference implementation; a Keysight DSO-X 3024T oscilloscope captured 21,200 traces of 8,333 points each, every trace paired with its true 16-bit sequence. The team trained on 19,000 traces, validated on 1,000 and tested on 1,200 held-out traces, using a convolutional front end, a two-layer bidirectional long short-term memory network and a CTC loss, on one consumer graphics card for 30 epochs. On the test set the pipeline reached 99.69 percent bit accuracy and 95.68 percent perfect recovery of the whole sequence, against 0.32 and 5.60 percent for two rigid-segmentation baselines. Removing the recurrent layers dropped perfect recovery to zero, and keeping the identical encoder while replacing CTC with frame-wise classification dropped it to 15.27 percent, an 80-point gap the authors attribute to the alignment mechanism alone.
The authors are exact about what the number means. The recovered sequence is a private-key-dependent intermediate, and it is not the private key. Turning it into a key would take many chosen-ciphertext executions, each forcing the syndrome into a rotation of the private polynomial, followed by information-set decoding of the kind used in earlier BIKE attacks. The paper implements none of that stage and claims no key recovery. The results also hold only in the profiled, same-platform setting they were measured in: transfer across devices, sessions, implementations and keys is untested, and so is the effect of masking or instruction shuffling.
Why BIKE's constant-time repair left a readable branch: the 2023 rotation leak, the current reference code, and the cost of masking the decoder
The paper's place in the BIKE attack literature explains why it targets the decoder at all. In 2023 Cheriere, Aragon, Richmond and Gérard recovered a full BIKE private key from a Cortex-M4 implementation with a single trace by exploiting the rotation of an array during the private-key-dependent polynomial multiplication, then finishing with information-set decoding. The BIKE team responded: the current reference implementation replaces that multiplication with a constant-time routine, and the optimized BIKE package maintained by Drucker, Gueron and Kostic states that every function in it runs in constant time, with a constant-time BGF decoder. Chen and Li confirm that the rotation leak is gone from the reference code and then show that the counter-increment branch outcomes inside BGF still produce a data-dependent power signature. Two cautions follow. The paper attacks the unprotected reference implementation and reports no result against the optimized package. And a constant-time property, which removes timing and memory-access dependence on the secret, says nothing about power consumption on a microcontroller, which is exactly the channel used here.
The remedy for that channel is masking, and its implementation-specific price has been measured for BIKE. In April 2024 Loïc Demange of Thales and Inria and Mélissa Rossi of ANSSI published the first provably masked implementation of a code-based scheme, a fully masked BIKE covering key generation, encapsulation and decapsulation, and measured the slowdown at 5.8 times for first-order masking and 55.6 times for fifth order against an unmasked, unoptimized BIKE build. Those benchmark factors do not establish the cost on a constrained radio, a battery-powered sensor node or another deployed device. The Shandong team did not test whether their reader survives even first-order protection, so masking's efficacy against this experiment remains untested.
Learning-based tools now probe post-quantum cryptography at both ends. Earlier this year the Monitor read how sixty hours of AI cryptanalysis retired the Hawk signature scheme at the level of the mathematics; this paper applies a learned model to the physics of one implementation. The mathematics of ML-KEM and HQC are untouched by either result. The implementation side is where the same question is being asked of every chip that will carry them.
Quantum pillar: post-quantum cryptography (cryptanalysis of PQC candidates). Use posture: offensive. Technology readiness: TRL 3 of 9. The leakage-extraction step ran for real on an ARM Cortex-M4 development board in a laboratory with an oscilloscope, which places it at experimental proof of concept, while the full key-recovery chain that would demonstrate full key recovery was not built and no protected or foreign device was tested.
Who gains from an alignment-free side-channel reader: the offensive reading, and what it means for the ML-KEM and HQC code a force will field
Read as capability, the paper publishes an extraction technique whose value lies in recovering secrets from an adversary's hardware, so the posture is offensive. The party that gains is a laboratory with physical possession of a device, or of an identical twin to profile on, and a few hours of measurement time: a captured radio, a seized authentication token, a field sensor node left behind. What the technique would let such a laboratory do is skip the manual work of finding and aligning points of interest, the step that has kept profiled attacks on long, irregular traces expensive. The defensive benefit is indirect: an evaluation lab now has a documented method to test its own boards against.
The transfer question decides how much of this matters beyond BIKE. HQC, the scheme NIST did select in NIST Internal Report 8545 of March 2025, is also code-based and also decodes, and its decoder runs different arithmetic over a different code family, so the Shandong leakage model does not carry over unexamined. ML-KEM, the lattice scheme already moving into silicon, which the Monitor followed as ML-KEM entered the hardware test lab, has no bit-flipping decoder at all, and its side-channel literature centers on the number-theoretic transform and message decoding. What may transfer is the formulation rather than the leak: any implementation with secret-indexed conditional branches spread unevenly across a long trace is a candidate for a sequence-to-sequence reader, and the paper names FPGA and ASIC targets and other code-based schemes as the next places to try it.
What stands between a 16-bit laboratory recovery and a key-recovery capability a program office would plan against
The distance is long, and the paper itself lists most of it. The full-key stage is missing, and building it means an active chosen-ciphertext campaign against the device rather than passive listening. The model was trained and tested on one board in one session; a second unit of the same part or a different firmware build could shift the traces enough to break a profiled model, and no transfer experiment is reported. Every trace came from an unprotected build, so a masked or shuffled implementation sits outside the evidence and should be required in a defense procurement specification for any device an adversary can hold. The attacker also needs the device, or a twin, in hand. And the scheme is one NIST declined to standardize, so its footprint in fielded equipment is small.
For a buyer of post-quantum equipment the reading is practical. A vendor claim that an implementation is constant-time answers the timing question and leaves the power question open. The evidence a program office should ask for is a side-channel evaluation of the specific build on the specific part, against a profiled attacker with device access, with the countermeasure order and its performance cost stated.
What the sources establish is a reproducible extraction of 16 private-key-dependent bits from the current BIKE reference decoder on one microcontroller, with ablation evidence showing which component did the work. What they do not establish is a key recovery, a result on any protected build, any cross-device transfer, or any result on HQC or ML-KEM. The results to watch for are a follow-up that closes the chosen-ciphertext and information-set-decoding stage, a cross-device evaluation, a test against the Demange and Rossi masked implementation, and a first application of the same formulation to the HQC decoder.
Sources
Primary source: Geng Chen, Yanbin Li, Shilin Sun, Zongyue Wang, Chunpeng Ge, Fusheng Wu and Qiuliang Xu, "A deep learning based side-channel attack on BIKE," Cybersecurity 9:215, published September 16, 2026 (CC BY 4.0), DOI 10.1186/s42400-026-00653-9. Other material: NIST Internal Report 8545 (March 2025) on the fourth round of the post-quantum standardization process; the constant-time BIKE-KEM implementation by Drucker, Gueron and Kostic on GitHub; Loïc Demange and Mélissa Rossi, "A provably masked implementation of BIKE Key Encapsulation Mechanism," IACR Communications in Cryptology, April 2024.