Paper 2025/1344 Original: eprint.iacr.org/2025/1344 ↗

Side-Channel Sensitivity Analysis on HQC: Towards a Fully Masked Implementation

Guillaume Goy
Maxime Spyropoulos
Nicolas Aragon
Philippe Gaborit
Renaud Pacalet
Fabrice Perion
Laurent Sauvage
David Vigilant
Abstract

Hamming Quasi-Cyclic (HQC) has recently been officially selected for standardization by NIST as a post-quantum KEM alternative to ML-KEM. This milestone raises new requirements, in particular the need to design and deploy secure implementations of the scheme. This paper presents two major contributions to secure HQC against Side-Channel Attacks (SCAs). First, we present a detailed sensitivity analysis of HQC, highlighting the critical variables and critical internal functions that need to be protected. Second and main contribution, we propose the first fully masked HQC implementation at any order. It is also the first PQC masked implementation that is formally proved to be secure in the MIMO-SNI security model. This security, introduced by Cassiers and Standaert in 2020, ensures the security of gadgets composition against propagating probes. In this paper, we provide benchmarks of our implementation, showing that our masked implementation is competitive in the state-of-the-art masked PQC implementations.

Metadata
Available format(s)
PDF
Category
Implementation
Publication info
Preprint.
History
2025-07-23: last updated
2025-07-23: published
Short URL
https://ia.cr/2025/1344
License
https://creativecommons.org/licenses/by/4.0/

BibTeX

@misc{cryptoeprint:2025/1344,
      author = {Guillaume Goy and Maxime Spyropoulos and Nicolas Aragon and Philippe Gaborit and Renaud Pacalet and Fabrice Perion and Laurent Sauvage and David Vigilant},
      title = {Side-Channel Sensitivity Analysis on HQC: Towards a Fully Masked Implementation},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/1344},
      year = {2025},
      url = {https://eprint.iacr.org/2025/1344}
}
Note: In order to protect the privacy of readers, this archive does not use cookies or embedded third party content.