HQC (Hamming Quasi-Cyclic Key Encapsulation Mechanism)

non-FIPScode-based3 parameter setsQNSP tier: strict+provider: liboqsalso called: Hamming Quasi-Cyclic

Code-based KEM selected by NIST in March 2025 as a fifth-round alternate KEM standard, providing an independent cryptographic assumption (coding theory, not lattices) as defence-in-depth against ML-KEM cryptanalysis.

HQC builds on the hardness of decoding random linear codes over F2. Public keys and ciphertexts are vectors in a quasi-cyclic code; encapsulation produces a noisy codeword that only the secret key can decode. Selected by NIST specifically as an independent assumption-economy fallback to ML-KEM (lattice-based).

Variant	NIST Level	Public Key	Secret Key	Ciphertext
HQC-128	L1	2,249 B	2,289 B	4,481 B
HQC-192	L3	4,522 B	4,562 B	9,026 B
HQC-256	L5	7,245 B	7,285 B	14,469 B

@noble/post-quantum

non-addressable

Pure-JavaScript reference; cross-verification secondary on Maximum + Government tiers.

@cuilabs/liboqs-native

non-addressable

Native-C primary production engine. Runs across every QNSP backend service.

NIST ACVP vectors for HQC are not yet published.

View live ACVP evidence →

Defence-in-depth: pair HQC with ML-KEM where the cost of a lattice-cryptanalysis break would be catastrophic
Maximum / Government tier policy that mandates dual-family coverage

Significantly larger keys and ciphertexts than ML-KEM
Independent cryptographic assumption from ML-KEM (defence-in-depth)
Slower than ML-KEM by a meaningful margin in practice

HQC

How it works

3 variants shipped

Conformance evidence

When to use it

What you give up, what you get

Primary sources