george0papasotiriou/cve-2026-23006-kyber-ciphertext-length-side-channelPython PoC for CVE-2026-23006, demonstrating a Kyber ciphertext length side-channel that leaks secret key bits via statistical analysis of variable-length outputs.
# kyber_length_leak.py - Leaks secret key bit based on ciphertext length
import random
# Simulate encapsulation: ciphertext length depends on message bit
def encapsulate(pk, bit):
# In a flawed implementation, the ciphertext size varies based on a secret bit
if bit:
return b'\x00' * 800 # long ciphertext
else:
return b'\x00' * 768 # short ciphertext
# Attacker observes lengths
lengths = []
for _ in range(100):
ct = encapsulate(None, random.randint(0,1))
lengths.append(len(ct))
# Histogram reveals two clusters -> secret bit leakage
print("Ciphertext lengths leak secret bit.")
A flawed implementation of the Kyber key encapsulation mechanism produces ciphertexts of different lengths depending on a secret bit in the shared secret. An attacker measuring the length of multiple ciphertexts can recover the bit with statistical analysis.
Run the simulation:
python kyber_length_leak.py
Observe two distinct length clusters.