HqcLethe streams HQC encapsulation for stateless post-quantum handshakes
Original title: HqcLethe: Streaming HQC Encapsulation for Tiny Stateless Servers
Chinese-remainder splitting keeps each Raspberry Pi worker in fixed memory and is checked in Rocq and ProVerif.
The paper presents HqcLethe, a stateless exchange that streams NIST-selected HQC encapsulation in packet-sized pieces. It responds to BSI advice against Classic McEliece and to the memory cost of buffering multi-packet HQC handshakes in designs such as post-quantum WireGuard. Remainders are masked so they reveal no more than an ordinary ciphertext, with proofs in Rocq using SSProve and session properties in ProVerif. Client puzzles limit CPU use, and the design reports lower bandwidth and server CPU than McTiny.
Unconfirmed: Performance and proof results are the authors' claims; independent review is not reported.
- Each worker uses a fixed 1.2-1.6 MiB on a Raspberry Pi 3B+.
- At category 5 it sends 27x fewer bytes than McTiny.
- It uses 9.0x less server CPU than McTiny at category 5.
- ProVerif checks cover session secrecy, server authentication and forward secrecy.
- Countries
- Germany
From the original article
1 min read at arxiv.orgStateless post-quantum authenticated key exchanges such as post-quantum WireGuard hedge against unexpected cryptanalytic advances by combining a lattice KEM with code-based Classic McEliece. However, recent attacks have led Germany's BSI to advise against McEliece, which leaves these protocols with lattices alone.
By Wind Wong · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.