The Key That Doesn’t Leak:
Why DPA Cannot Work on Balanced Ternary

The Attack That Changed Hardware Security

In 1999, Paul Kocher, Joshua Jaffe, and Benjamin Jun published a paper that devastated the smartcard industry. It was called “Differential Power Analysis.” Within a year, chips that had passed every cryptographic security audit in existence were being broken in hours using nothing more than an oscilloscope, a few thousand encrypted messages, and a personal computer.

The attack did not find a weakness in AES. It did not factor an RSA key. It did not exploit a software bug. It exploited the fact that the power consumption of a cryptographic chip varies with the data it is processing — and that this variation is statistically correlated with the secret key. Measure the power trace, apply standard statistics, recover the key.

The principle is disarmingly simple. Every time a CMOS gate switches from 0 to 1, it charges a capacitor from ground to V_DD. Every time it switches from 1 to 0, it discharges that capacitor back to ground. The charge-and-discharge cycle consumes power proportional to C·V²·f. Critically, a gate switching to 1 consumes power; a gate holding at 0 does not. The power consumption of a binary gate is directly and physically linked to the value it is computing.

Run an AES encryption. Collect the power trace. The trace is noisy, but the signal is there. Guess one byte of the key, predict the intermediate value after the first S-box substitution, compute the hypothetical power trace for every possible key guess, and correlate each hypothesis against the measured trace. The correct key byte hypothesis produces the highest correlation. Repeat for all 16 bytes. Full 128-bit AES key recovered in minutes.

This is not a theoretical attack. It has been demonstrated on smartcards, microcontrollers, FPGAs, and ASICs. The banking sector has spent hundreds of millions of dollars defending against it. Every hardware security certification — Common Criteria, EMVCo, FIPS 140 — now requires DPA countermeasures. And still, every countermeasure is an attempt to patch a leak that runs through the foundations of binary logic itself.

Why Binary Leaks by Construction

To understand why balanced ternary is different, you first need to understand why binary leaks at all. It is not a bug. It is not a design flaw. It is an inescapable consequence of how binary information is physically embodied.

In CMOS logic, a bit has a physical representation: a voltage level. Logic 1 is V_DD. Logic 0 is ground. These are not equal. They are physically different states, and the circuit must do real physical work to move between them. Switching from 0 to 1 charges the gate capacitance; switching from 1 to 0 discharges it. The work involved depends on the data value.

Now consider an AES S-box. It maps each 8-bit input byte to an 8-bit output byte. Each output bit is a nonlinear function of the input. When the input changes, some output bits flip from 0 to 1 (charging their load capacitances), others flip from 1 to 0 (discharging), and others do not change. The number of bit flips — the Hamming distance between consecutive output values — determines the power consumed in that clock cycle. And because the Hamming distance depends on the intermediate value, which depends on the key, the power depends on the key.

This is the Hamming distance model of power consumption, and it underlies virtually all DPA attacks. The model does not require precise knowledge of the circuit. It does not require reverse-engineering the chip. It only requires that data-dependent switching activity exists — and in binary CMOS, it always does.

Binary physically encodes 0 and 1 as different voltages. Different voltages require different amounts of work to switch between. Power analysis measures that work. There is no binary circuit that cannot be attacked in principle — only circuits where the attack is made harder.

Twenty-Five Years of Countermeasures

The cryptographic engineering community has developed an extensive toolkit for fighting DPA. None of these countermeasures cure the underlying problem. They all attempt to make the correlation between power and data harder to extract.

Masking is the most widely deployed technique. Before processing, the secret value is XORed with a random mask. Operations are then performed on the masked value. The mask is removed at the end. Since the power trace now depends on the masked intermediate value (which is random), the correlation with the actual key is broken — in theory. In practice, higher-order DPA can still exploit correlations between multiple intermediate values and recover the key, requiring multiple layers of masking to resist.

Clock randomisation inserts random wait states between operations, misaligning power traces so that averaging them together produces noise rather than a clean signal. An attacker responds with preprocessing techniques that re-align traces before correlation.

Dummy operations insert computations whose results are discarded, adding noise to the power trace. An attacker with enough traces can average out the noise.

Balanced logic styles — differential or dual-rail logic — attempt to ensure that every computation consumes the same power regardless of the data value. This is extraordinarily difficult to achieve in practice because even minute asymmetries in layout, wire length, or transistor threshold voltage reintroduce the correlation.

Every one of these measures adds area, power consumption, latency, and design complexity. Every one of them has been partially defeated. And every one of them is necessary precisely because the problem they are patching is baked into binary encoding at the physics level.

What Balanced Ternary Does Differently

The THATTE device encodes trits as signed current on a metallic ballistic carbon nanotube transmission line. The three trit values produce these operating points, confirmed by NEGF quantum transport simulation of the (8,8)@(13,13) DWCNT:

Look at trit +1 and trit −1. The magnitudes are identical: 74 µA, 37 µW. The current directions differ, but the power dissipated in the ballistic channel is the same. This is not an engineering achievement. It is a mathematical consequence of the symmetry I(+V) = −I(−V), which holds exactly for any conductor obeying time-reversal symmetry — and which is verified to four significant figures in the NEGF simulation.

Now consider what DPA needs. It needs a statistical correlation between the data being processed and the power consumed. In binary, this correlation exists because 0 and 1 have different power signatures. In balanced ternary on the THATTE device, trit +1 and trit −1 have identical power signatures. An attacker measuring the power trace cannot distinguish between them energetically. The correlation that DPA depends on does not exist.

The Physics Behind the Immunity

The current symmetry is not an accident of tuning or a property that must be carefully maintained. It is a consequence of what the SWCNT fundamentally is: a one-dimensional ballistic conductor obeying time-reversal symmetry.

In a ballistic conductor, electrons traverse the channel without scattering. The current is determined by the Landauer formula: I = (2e²/h) · T · V, where T is the transmission coefficient and V is the applied voltage. The transmission coefficient of a metallic armchair SWCNT is a property of its band structure, not of the voltage polarity. It does not change sign when the voltage reverses. Therefore I(+V) = −I(−V) exactly.

This is also why trit encoding by AC phase polarity is the natural choice for this device. The AC waveform’s positive half-cycle gives +74 µA; the negative half-cycle gives −74 µA. The magnitudes are identical because the underlying physics is symmetric. You do not engineer this symmetry into the device — you read it out of the physics and let it work for you.

The NEGF simulation of the (8,8) SWCNT inside the (13,13) MWCNT confirms this at the quantum transport level. The current symmetry ratio |I(−1) / I(+1)| is 1.0000 to four significant figures. Any power analysis that collects traces corresponding to trit −1 and trit +1 operations and attempts to separate them by power will find no correlation. The distributions are identical.

Trit Zero: The Quiet State

In balanced ternary, trit 0 is the absence of signal. No photon is present. No AC voltage is applied. The SWCNT sits at its equilibrium state, conducting nothing. The measured current at trit 0 is the thermal noise floor — approximately 35 nanoamperes, more than 2,000 times below the signal current at ±74 µA. Power dissipation is effectively zero.

This is fundamentally different from a DC ternary zero state. In a hypothetical DC ternary system, the “zero” state requires a maintained midpoint voltage — power is consumed holding the node at V_DD/2. The zero state has a power signature. In the THATTE device, trit 0 consumes no power because it is the true absence of a signal, not a constructed intermediate level.

The power trace of a balanced ternary cryptographic computation therefore has three possible states: active positive (+37 µW), silent (0), and active negative (−37 µW). A DPA attacker who correlates power against hypothetical key guesses finds:

• When the intermediate value is +1: power ≈ +37 µW
• When the intermediate value is −1: power ≈ −37 µW
• When the intermediate value is 0: power ≈ 0

The power trace does vary with the trit value — the zero state is distinguishable from the active states. What the attacker cannot distinguish is trit +1 from trit −1. These are the informationally distinct values (the two non-zero trits carry the sign bit of the encoded quantity), and they are power-identical. Statistical correlation between power and the hypothetical key byte — which is what DPA computes — finds no signal.

DPA needs to distinguish −1 from +1 to correlate against the key. Both consume 37 µW. The attack has nothing to measure.

No Memory, No Cache Timing

Power analysis is not the only physical side-channel. Cache timing attacks exploit the data-dependent latency of memory access: if a lookup table entry is in cache, the access is fast; if it must be fetched from DRAM, the access is slow. By measuring computation latency across many inputs, an attacker can determine which table entries were accessed and thereby recover the key. The classic example is the cache-timing attack on AES by Bernstein (2005), which recovered an AES key by measuring remote timing variations over a network.

AES uses S-boxes: 256-entry lookup tables. Every SubBytes operation accesses one table entry per input byte. The access pattern leaks information about the key material through cache timing. Defending against this requires either loading the entire S-box into cache before each operation (wasted cycles), using bitsliced implementations with no table lookups (significant implementation complexity), or relying on hardware AES instructions that promise constant-time execution (an engineering guarantee that must be verified per-microarchitecture).

The ternary cipher in the THATTE security stack uses substitution boxes implemented as combinational circuits of TMAJ3 majority gates — not as lookup tables. The TMAJ3 gate computes the median of three trit inputs combinationally, with no memory access of any kind. There is no table to cache. There is no latency variation based on which entry is fetched. The timing of every S-box computation is identical, determined solely by gate propagation delay — which in a ballistic conductor is set by wave transit time, not by data value.

Both the power side-channel and the timing side-channel are closed, and neither closure requires a countermeasure. Both are structural properties of the device and the circuit architecture.

The Ternary TRNG: Entropy From Quantum Noise

A cryptographic system is only as strong as its random number generator. Binary TRNGs harvest entropy from physical noise processes — thermal noise, shot noise, metastability in bistable circuits — and convert it to a stream of random bits. The conversion from an analogue noise source to digital bits always involves a threshold decision, introducing potential bias and requiring careful post-processing to pass statistical tests.

The THATTE device offers a qualitatively different entropy source: the quantum mechanical timing jitter of photon arrivals at the photonic crystal cavity. Photon arrival is a Poisson process. The inter-arrival times are exponentially distributed. The jitter in the arrival time relative to the AC clock phase determines whether the device samples a trit +1, 0, or −1 at the moment of photon detection. This is a native three-valued random process — it produces trits directly, without binary-to-ternary conversion.

The entropy source is quantum mechanical in origin. Unlike classical noise sources (which can in principle be predicted given sufficient knowledge of the physical state), quantum arrival-time uncertainty is irreducible. There is no hidden variable that an adversary could measure to predict the next output trit. The randomness is fundamental.

What This Means in Practice

In binary hardware security, DPA countermeasures are an afterthought — they are added to an otherwise complete design to patch a vulnerability that the underlying technology cannot avoid. The result is a layered defence: masking on top of balanced logic on top of clock randomisation on top of the leaky binary core. Each layer adds cost. Each layer is partially defeatable. Each layer represents engineering effort spent compensating for a fundamental physics problem.

In the THATTE balanced ternary stack, the relationship is inverted. The physics closes the DPA side-channel as a consequence of the AC transmission-line paradigm. No masking is needed. No clock randomisation is needed. No balanced logic style needs to be carefully implemented and verified. The security property is structural, not procedural.

This does not mean a balanced ternary cryptographic implementation is unconditionally secure against all side-channels. Higher-order attacks that correlate the zero state against the active states can extract partial information about the data distribution. Electromagnetic emanation, acoustic emanation, and fault injection are separate attack classes that require separate analysis. The claim is specific: the differential power analysis attack in its standard form — the attack that correlates a power model of the non-zero trit values against a measured power trace to recover a key — has no correlation to exploit. Not because the correlation has been suppressed. Because it was never there.

Twenty-five years of DPA countermeasures represent the binary computing world trying to contain a problem it created for itself by choosing asymmetric physical encoding. Balanced ternary did not choose that encoding. The trit alphabet is symmetric by design — {−1, 0, +1} is centred on zero, with equal and opposite non-zero values. And when you implement it on a device whose operating physics enforces I(+V) = −I(−V), the symmetry of the alphabet maps directly to the symmetry of the power consumption. The key does not leak. Not because it has been protected. Because there is nothing for a side-channel to measure.