Jihoon Jang and colleagues have achieved a 2.92 millisecond TLS handshake latency using an optimized HQC implementation, a reduction from 3.22 milliseconds reported by prior methods. The researchers focused on accelerating the HQC code-based key encapsulation mechanism for resource-constrained IoT gateways, integrating it into TLS 1.3 and using Intel’s AVX-512 and Galois Field New Instructions. Their work demonstrates a 29.5% reduction in HQC key generation time relative to previous AVX-512 implementations, while also highlighting that HQC’s public-key and ciphertext sizes, not speed, currently limit performance on constrained networks.

Accelerating HQC for Post-Quantum TLS 1.3 on x86 IoT Gateways

Polynomial multiplication within the HQC key encapsulation mechanism benefits from optimized implementation, as demonstrated by new work focusing on x86 processors. On an Intel Core i5-1135G7 processor, the AVX2 implementation reduces decapsulation by 11.1-21.5% over the fastest prior AVX2 results. The AVX-512 implementation reduces key generation by 24.9-29.5%, encapsulation by 10.4-11.1% and decapsulation by 20.6-26.1% relative to Cabral et al. across the three HQC parameter sets.

The researchers extend branch-free Toom-Cook/Karatsuba multiplication to AVX-512, accelerate Reed-Solomon decoding with GFNI, improve Reed-Muller decoding, accelerate SHA3-512 and fixed-weight sampling, and port Frobenius additive FFT (FAFFT) multiplication to AVX-512 + GFNI for HQC-5. The team’s work indicates that HQC public-key and ciphertext sizes, rather than implementation speed, determine the remaining handshake cost on constrained links.

On a constrained network with 1 Mbit/s bandwidth and 50ms round-trip time, HQC-5 handshake time reached 243 milliseconds, significantly slower than the 87 milliseconds recorded for ML-KEM-1024. This disparity suggests that HQC’s communication size, rather than its computational speed, becomes the limiting factor in bandwidth-limited scenarios.

TLS 1.3 Integration of Optimized HQC Implementations

Optimized implementations of the HQC algorithm reduce TLS 1.3 decapsulation times by up to 21.5% over previous AVX2 results, demonstrating performance gains on standard Intel processors. These improvements were achieved through integration with liboqs and oqs-provider, allowing for direct measurement of the impact on handshake latency and CPU costs for both server and client systems.

Measurements distinguish between improvements at the implementation level and the effects of varying network conditions, including round-trip time and bandwidth. Analysis revealed that the HQC-5 ciphertext necessitates an additional round trip when using the default TCP initial congestion window, a factor impacting overall handshake speed.

The study focused on assessing the division of handshake costs between server and client roles, providing a detailed breakdown of performance characteristics within a TLS 1.3 stack. “This paper presented optimized HQC implementations for AVX2 and AVX-512 + GFNI, and evaluated them in TLS 1.3 on x86 IoT gateways,” the authors state, highlighting the focus on resource-constrained devices.

AVX2 Optimizations for HQC Polynomial Multiplication

Recent processor capabilities, including AVX-512, VPCLMULQDQ and GFNI, provided a foundation for optimizing the HQC cryptographic scheme. While previous AVX-512 implementations of HQC, such as those by Cabral et al., addressed polynomial multiplication and decoding, they did not fully use GFNI within the Reed-Solomon decoder, relying instead on PCLMULQDQ-based field multiplication for syndrome and error-value computations. Further limitations existed in the scalar nature of SHA3-512 oracles and the use of AVX2 for single polynomial multiplication and support expansion.

The current work extends optimizations across multiple phases of HQC key encapsulation. The researchers note that reusing the transform of r₂ for two polynomial products further enhances efficiency, as detailed in Table VI. Table VII provides a detailed breakdown of cycle counts for HQC KEM operations on AVX-512, demonstrating the impact of these optimizations on computational efficiency.

Significant gains in decoding speed were achieved through the implementation of Galois Field New Instructions (GFNI)-based arithmetic within the Reed-Solomon decoder. The researchers also optimized Reed-Muller decoding by replacing a binary search with a horizontal vector reduction, further enhancing performance across both AVX2 and AVX-512 architectures.

AVX-512 Enhancements to HQC’s Keccak Functions

The optimization of Keccak-based functions within the HQC cryptography scheme yielded substantial performance gains, particularly in Reed-Solomon decoding. The team integrated this optimized decoder into the broader HQC key encapsulation mechanism (KEM) to accelerate TLS 1.3 on resource-constrained devices. The work extends beyond Reed-Solomon decoding to encompass the entire suite of symmetric primitives used by HQC, all built upon the Keccak-f permutation. This strategy, combined with optimizations to SHA3-512 and support expansion for fixed-weight sampling, contributes to overall system efficiency.

Analysis of cycle counts reveals the contribution of each component to the overall KEM performance on an Intel Core i5-1135G7 processor. The data, presented in the paper, highlights the impact of these optimizations on the HQC-5 parameter set. The results demonstrate that a comprehensive approach, optimizing individual components like polynomial multiplication and decoding alongside Keccak-based functions and support expansion, is important for achieving significant performance improvements in cryptographic systems.

Impact of HQC-5 Ciphertext Size on Constrained Links

HQC-5 ciphertext size, not computational speed, ultimately limits handshake performance on connections with limited bandwidth, according to new analysis of cryptographic implementations. This disparity indicates that the larger data volume of HQC, rather than processing time, becomes the primary bottleneck in these constrained network scenarios. The study integrated optimized HQC implementations into TLS 1.3, evaluating their impact on both handshake latency and CPU load on server and client devices.

Optimized Reed-Solomon decoding significantly reduces computational load within the HQC key encapsulation mechanism. Table VII details cycle counts for HQC key encapsulation operations on AVX-512, revealing performance improvements across key generation, encapsulation and decapsulation.

👉 More information
🗞 Accelerating HQC for Post-Quantum TLS 1.3 on x86 IoT Gateways
✍️ Jihoon Jang, Hyunju Park, Jebin Kim, Seokhie Hong and Suhri Kim
🧠 ArXiv: http://arxiv.org/abs/2610.11107v1

More like this