Algorithms
What is HQC?
Hamming Quasi-Cyclic. NIST-selected code-based KEM (March 2025). Three parameter sets (128, 192, 256). Not currently offered by QNSI: liboqs disables HQC by default pending its corrected 2025-spec implementation (an unresolved design flaw, CVE-2025-48946), so QNSI ships code-based backups via Classic McEliece and BIKE instead.
Decision context
Why HQC matters
HQC is a code-based KEM selected for continued NIST standardization and provides design diversity from lattice KEMs. That diversity can reduce dependence on one mathematical family, but selection does not by itself make every available implementation current, enabled, interoperable, or production-ready.
How to evaluate HQC
Verify the exact specification revision and implementation commit, including responses to published cryptanalytic and implementation findings. Run the matching vectors and negative tests, record whether the provider enables HQC by default, and label unavailable or experimental support honestly rather than counting a compiled symbol as a deployed capability.
Algorithms
Algorithms evidence boundary
Algorithm names alone do not establish security or deployment readiness. Parameter set, implementation, key and signature sizes, execution boundary, validation status, and failure behaviour all matter. Buyers should distinguish a standardized primitive from a product path that has independently demonstrated that primitive in production.
FAQ
Common questions
What is HQC?
Hamming Quasi-Cyclic. NIST-selected code-based KEM (March 2025). Three parameter sets (128, 192, 256). Not currently offered by QNSI: liboqs disables HQC by default pending its corrected 2025-spec implementation (an unresolved design flaw, CVE-2025-48946), so QNSI ships code-based backups via Classic McEliece and BIKE instead.
Why does HQC matter?
HQC is a code-based KEM selected for continued NIST standardization and provides design diversity from lattice KEMs. That diversity can reduce dependence on one mathematical family, but selection does not by itself make every available implementation current, enabled, interoperable, or production-ready.
How should HQC be evaluated?
Verify the exact specification revision and implementation commit, including responses to published cryptanalytic and implementation findings. Run the matching vectors and negative tests, record whether the provider enables HQC by default, and label unavailable or experimental support honestly rather than counting a compiled symbol as a deployed capability.
More