HQC: NIST's Code-Based Backup to ML-KEM
HQC (Hamming Quasi-Cyclic) is a post-quantum Key Encapsulation Mechanism that NIST selected in March 2025 as a second, structurally independent KEM to sit alongside ML-KEM (FIPS 203). Where ML-KEM's security rests on lattice problems, HQC's security rests on the hardness of decoding random quasi-cyclic codes — a completely different mathematical foundation. If a future cryptanalytic breakthrough ever weakened lattice-based schemes, an HQC-based system would be unaffected. Status note: HQC is selected but not yet a final FIPS — NIST is still drafting the formal standard, expected in early 2026 with finalization projected for 2026–2027.
Parameter Sets
| HQC Variant | Security | pk Size | sk Size | Ciphertext |
|---|---|---|---|---|
| HQC-128 | 128-bit | ~2,249 B | ~2,289 B | ~4,497 B |
| HQC-192 | 192-bit | ~4,522 B | ~4,562 B | ~9,042 B |
| HQC-256 | 256-bit | ~7,245 B | ~7,285 B | ~14,485 B |
Recommended: HQC-192 for most applications. Note HQC's keys and ciphertexts run noticeably larger than ML-KEM's equivalent security levels — a trade-off for its different hardness assumption.
Security Analysis
| Attack | Resistance |
|---|---|
| Shor's Algorithm | Secure — no exponential speedup against code-based decoding problems |
| Grover's Algorithm | Only quadratic speedup — 256-bit key → 128-bit effective security |
| Information-Set Decoding Attacks | Best known classical attacks remain far outside practical reach at HQC-128 and above |
References
- NIST CSRC — PQC Standardization Process
- HQC official specification site
- Open Quantum Safe (OQS)
- KF-Cipher PQC Standards Tracker — live status of HQC and other NIST algorithms