HqcLethe streams HQC encapsulation, cutting bytes 27× and CPU 9×

The five-minute version

HQCLETHE streams HQC encapsulation using CRT residues, removing the need for a server to buffer large keys and eliminating memory-exhaustion attacks. It cuts bandwidth by 27× and server CPU by 9.0× versus McTiny, while keeping per-worker memory fixed at 1.2-1.6 MiB. However, it uses 1.9-4.1× more CPU than a stateful buffering baseline and suffers higher latency under packet loss.

What they found 2

• Bandwidth and CPU reduction versus McTiny

  “at category 5 it sends 27× fewer bytes and uses 9.0× less server CPU than McTiny”

• Fixed low memory per worker on a Raspberry Pi

  “on a Raspberry Pi 3B+, each worker runs in a fixed 1.2-1.6 MiB”

What undercuts it the paper’s own results

• Stateless server costs more CPU than a stateful buffering baseline (1.9×-4.1× higher).
• Higher latency under packet loss: median 0.165-0.170 s versus 0.048-0.049 s for the stateful baseline.

Stated limits 3

• at d = 16 the Pi spends 14× as much time per puzzle as the attacker, so d = 16 is too low for the Pi.
• Forward secrecy in HQCLETHE rests on one family, HQC, just as it rests on lattices alone in prior designs.
• Embedding it in a full protocol is future work.

What’s new here 4

• First stateless key-exchange that streams HQC encapsulation in packet-sized pieces using CRT residue splitting.
• Masks the CRT residues to hide unreduced polynomial products, proving zero-leakage against an ordinary HQC ciphertext.
• Removes memory-exhaustion DoS surface for tiny servers, requiring only 1.2-1.6 MiB per worker.
• Provides mechanized security proofs in Rocq/SSProve and ProVerif for the streaming construction.

Artifacts & methods 7

• CRT-based residue streamingprimitive
• Masked CRT residuesprimitive
• Rust implementation (Raspberry Pi, x86)system
• Rocq/SSProve mechanized prooftheory
• ProVerif protocol analysistheory
• McTiny baselineevaluation
• Stateful buffering baselineevaluation

Topics