A code-based quantum-safe encryption chosen by NIST in 2025 as a backup to ML-KEM, built on different math.
The idea: HQC also hides a message behind deliberate errors, but without disguising a special code. The public key mixes a random vector with two secret vectors that are mostly zeros. The sender adds more of that kind of sparse noise. The key holder uses the secret to cancel almost all of it. What's left is a codeword of a public, well-known code with a few errors, which it corrects. So security rests on decoding random structured codes, not on a disguise staying intact.
Why it matters: If lattices ever break, this is plan B.
On the map: NIST backup KEM (2025)
Hamming Quasi-Cyclic, a code-based key encapsulation scheme NIST selected in March 2025 as a backup to ML-KEM[1]. It rests on a different problem (decoding quasi-cyclic codes)[2, 3], so a breakthrough against lattices wouldn't break both. That problem is believed, not proven, to be as hard as decoding random codes.
Its keys are far smaller than McEliece's, and the BSI notes the 2026 attacks on McEliece's Goppa codes don't affect it[4]. NIST planned a draft standard about a year after selection and a final standard in 2027.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.