Paper 2025/1987

Single-Trace Key Recovery Attacks on HQC Using Valid and Invalid Ciphertexts

Qian Guo, Lund University

Denis Nabokov, Lund University

Abstract

As the Hamming Quasi-Cyclic (HQC) cryptosystem was recently selected by NIST for standardization, a thorough evaluation of its implementation security is critical before its widespread deployment. This paper presents single-trace side-channel attacks that recover the full long-term secret key of HQC, experimentally evaluated on a protected Cortex-M4 implementation. We introduce two distinct attacks that significantly advance the state of the art: a passive attack that uniquely models key recovery as a moderate-density parity-check (MDPC) decoding problem from a single valid ciphertext, and an active chosen-ciphertext attack employing a new probing strategy on a linear combination of secret key components for significantly improved efficiency. Both attacks are enabled by a new information set decoding (ISD) variant that exploits soft side-channel information, a contribution of broader importance to code-based cryptography. Our experiments show that a single trace suffices for full key recovery under realistic conditions, effectively defeating countermeasures such as codeword masking for the first time. We also show that several existing defenses are ineffective against the new attacks.

@misc{cryptoeprint:2025/1987,
      author = {Haiyue Dong and Qian Guo and Denis Nabokov},
      title = {Single-Trace Key Recovery Attacks on {HQC} Using Valid and Invalid Ciphertexts},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/1987},
      year = {2025},
      doi = {10.1007/978-3-032-25336-1_20},
      url = {https://eprint.iacr.org/2025/1987}
}