HQC: the code-based backup to ML-KEM

Short answer: In March 2025 NIST announced that it had selected HQC, a code-based key-encapsulation mechanism, as a backup to ML-KEM for general encryption. NIST says HQC is based on different math than ML-KEM, which could matter if a weakness were ever found in ML-KEM. At the time of that announcement, a draft standard was planned for about a year later and a final standard for about 2027, so check NIST for the current status.

What is the role of HQC?

In March 2025, NIST announced it had chosen HQC to serve as a backup for ML-KEM, which is the main algorithm for general encryption. This selection provides a second line of defense for tasks that safeguard internet traffic and stored data. NIST had standardized, the year before, a set of encryption algorithms that can keep data secure from cyberattacks by future quantum computers. HQC is designed to protect stored information as well as data that travels across public networks.

The selection of HQC addresses the possibility that quantum computers might someday be able to crack ML-KEM. The new algorithm complements the existing standard based on the quantum-resistant algorithm ML-KEM. Both algorithms are intended to protect data in transit and at rest.

How does HQC differ from ML-KEM?

HQC is based on different mathematics than ML-KEM. This mathematical distinction could be important if a weakness were discovered in ML-KEM. Because the algorithms rely on different underlying principles, a vulnerability in one does not necessarily imply a vulnerability in the other. NIST describes HQC as a second line of defense for general encryption.

ML-KEM remains the primary choice.

What is the standardization timeline?

As of the March 2025 announcement, NIST planned to issue a draft standard incorporating HQC in about a year, with a finalized standard expected in 2027. The agency will draft the standard and release it for public comment. After the review and adjudication process, the final version will be published in approximately two years.

That timeline is from March 2025. We have not checked whether the draft has since been published, so check NIST for the current status.

Why was HQC selected over other candidates?

NIST says it selected HQC after a thorough evaluation in the Fourth Round of the Post-Quantum Cryptography Standardization Process. The selection was detailed in NIST Internal Report 8545. This report explains the evaluation criteria, algorithm designs, and reasoning behind the choice. Specifically, it details why HQC was chosen over BIKE and why Classic McEliece was not selected.

NIST's fourth-round status report says that after three rounds of evaluation it selected the first algorithms to be standardized, and that the key-encapsulation mechanism selected was CRYSTALS-Kyber (ML-KEM). HQC will be the second post-quantum KEM, following ML-KEM.

FAQ

What did NIST select in March 2025?

HQC, as a backup for ML-KEM, the main algorithm for general encryption.

Why have a backup?

NIST says HQC is based on different math than ML-KEM, which could be important if a weakness were discovered in ML-KEM.

Is HQC a standard yet?

As of NIST's March 2025 announcement, no. NIST planned to issue a draft standard in about a year and a final one in about two years, with a finalized standard expected in 2027. Check NIST for the current status.

How does it relate to ML-KEM?

HQC will be the second post-quantum key-encapsulation mechanism NIST standardizes, following ML-KEM.

Where is the reasoning?

In NIST Internal Report 8545, which explains why HQC was chosen over BIKE and why Classic McEliece was not selected.