I recently found an exploitable timing leak in the reference implementation of Kyber (ML-KEM), the soon-to-be NIST standard for post-quantum key encapsulation.

Let’s see if you can spot it in the source code - msg is secret: “I don’t see it. Looks good to me?”

Sure does! It’s written to avoid any control-flow or data dependency on the message.

" ... "

Let’s look at an obviously insecure version of the same function. The following code leaks the bits of msg one by one: