Breaking Masked Kyber: ResNet-Based Masked Kyber Share Recovery Method

As post-quantum cryptography becomes the cornerstone of future security systems, it is crucial to understand its practical resilience under present side-channel analysis. In this paper, we propose an effective side-channel analysis method for the poly_tomsg() function in the decapsulation of the first-order mask implementation of CRYSTALS-Kyber (the NIST-selected post-quantum key encapsulation mechanism). Unlike previous methods that target individual bits, our method targets a masked shared byte. By systematically evaluating multiple neural network architectures (MLP, CNN, ResNet), we find that residual learning has the best robustness under low signal-to-noise ratios. The method achieves up to 98% average accuracy by training a ResNet18 network, and is able to recover m from a single trace with a success rate of over 38%, outperforming classical template attacks without trace alignment. These findings reveal that even well-implemented Boolean masking can be defeated by neural-based profiling attacks, thus emphasizing the need for stronger countermeasures in post-quantum cryptographic implementations.