A Timing Attack on the HQC Encryption Scheme. The HQC publickey encryption scheme is a promising codebased submission to NISTxe2x80x99s postquantum cryptography standardization process. The scheme is based on the decisional decoding problem for random quasicyclic codes. One problem of the HQCxe2x80x99s reference implementation submitted to NIST in the first round of the standardization process is that the decryption operation is not constanttime. In particular, the decryption time depends on the number of errors decoded by a BCH decoder. We use this to present the first timing attack against HQC. The attack is practical, requiring the attacker to record the decryption time of around 400 million ciphertexts for a set of HQC parameters corresponding to 128 bits of security. This makes the use of constanttime decoders mandatory for the scheme to be considered secure.

Implementing and Benchmarking Three LatticeBased PostQuantum Cryptography Algorithms Using SoftwareHardware Codesign It has been predicted that within the next tenfifteen years, quantum computers will have computational power sufficient to break current publickey cryptography schemes. When that happens, all traditional methods of dealing with the growing computational capabilities of potential attackers, such as increasing key sizes, will be futile. The only viable solution is to develop new standards based on algorithms that are resistant to quantum computer attacks and capable of being executed on traditional computing platforms, such as microprocessors and FPGAs. Leading candidates for new standards include latticebased postquantum cryptography (PQC) algorithms. In this paper, we present the results of implementing and benchmarking three latticebased key encapsulation mechanisms (KEMs) that have progressed to Round 2 of the NIST standardization process. Our implementations are based on a softwarehardware codesign approach, which is particularly applicable to the current stage of the NIST PQC standardization process, where the large number and high complexity of the candidates make traditional hardware benchmarking extremely challenging. We propose and justify the choice of a suitable systemonchip platform and design methodology. The obtained results indicate the potential for very substantial speedups vs. purely software implementations, reaching 28x for encapsulation and 20x for decapsulation.