Fifth quantum-secure encryption algorithm selected

The US National Institute of Standards and Technology (NIST) has selected a new algorithm for post-quantum encryption. The HQC algorithm is designed to act as a backup for ML-KEM, the primary algorithm for general encryption with key encapsulation. HQC utilizes a different set of mathematical operations compared to ML-KEM, providing redundancy and potential resilience in case a weakness is discovered in ML-KEM.

The ML-KEM algorithm is centered around structured lattices, while HQC employs error-correcting codes, a well-established concept in information security for many years. This distinction in mathematical foundations could prove crucial in enhancing the overall security landscape of encryption technologies.

NIST is set to introduce a draft standard that incorporates the HQC algorithm within approximately a year, with the finalized standard expected to be released in 2027. This strategic move by NIST aims to fortify the existing encryption framework and ensure the resilience of internet traffic and stored data against potential cyber threats, including those posed by quantum computing.

Notably, HQC is not intended to replace ML-KEM, which will continue to be the recommended choice for general encryption purposes. Dustin Moody, a mathematician leading NIST’s Post-Quantum Cryptography project, emphasized the importance of having a backup standard like HQC that offers a distinct mathematical approach to bolster the overall security posture.

Moody highlighted that while HQC may require more computing resources due to its lengthier nature compared to ML-KEM, its robust security features have convinced reviewers of its viability as a backup option. The selection of HQC underscores NIST’s commitment to advancing encryption technologies that can withstand evolving threats and emerging cryptanalysis techniques.

• NIST approves post-quantum encryption standards
• Europe leads on post-quantum encryption technology

Organizations are advised to continue transitioning their encryption systems to the standards finalized in 2024, as per Moody. The introduction of HQC serves as a proactive measure to address potential vulnerabilities and adapt to the evolving landscape of quantum computing, ensuring a resilient encryption framework for safeguarding sensitive data and communications.

As part of its ongoing efforts, NIST has successfully incorporated three encryption algorithms into finished standards, with ML-KEM forming the core of the standard known as FIPS 203. Additionally, FIPS 204 and FIPS 205 encompass digital signature algorithms for sender authentication, facilitating secure remote document signing processes.

HQC emerges as the sole encryption algorithm standardized from NIST’s fourth round of candidates, following a rigorous evaluation process. NIST has published a comprehensive report outlining the selection criteria and rationale behind choosing HQC over other candidate algorithms, underscoring its potential to enhance encryption security.

NIST’s roadmap includes releasing a draft standard centered around HQC for public feedback within a year, followed by a comment period and finalization of the standard in 2027. This iterative approach ensures transparency, stakeholder engagement, and continuous improvement in encryption standards to meet the evolving cybersecurity challenges of the digital age.