Researchers Expose Vulnerabilities in Post-Quantum Cryptography Schemes HQC and BIKE

A collaborative team of international researchers has uncovered a new class of hardware vulnerabilities affecting leading post-quantum cryptography schemes, demonstrating that current security implementations may overlook critical attack surfaces outside of standard verification components.

The research, detailed in a paper designated as Paper 2026/2492 on the Cryptology ePrint Archive, focuses on two prominent code-based Key Encapsulation Mechanisms (KEMs), namely HQC and BIKE. Both cryptographic schemes are leading contenders designed to secure digital communications against future threats posed by quantum computing.

The study was conducted by an academic and research team comprising Thales B. Paiva, Lucas C. Cardoso, and Marcos A. Simplicio Jr. from the University of São Paulo in Brazil, alongside Keerthi Kamalakshan, Hariprasad Valsaraj Kelassery, and Shivam Bhasin from NTU Singapore. Their findings reveal that sophisticated physical attacks can compromise these systems by targeting internal instructions during the decapsulation process rather than focusing solely on the Fujisaki-Okamoto transform, which has historically been the primary focus of security analyses for code-based KEMs.

Post-quantum cryptography has emerged as a vital field of study as governments, financial institutions, and technology corporations prepare for an era where quantum computers could potentially break widely used public-key cryptographic algorithms such as RSA and Elliptic Curve Cryptography. In response to this looming threat, the National Institute of Standards and Technology (NIST) has initiated efforts to standardize quantum-resistant algorithms. Code-based cryptography, which relies on the hardness of decoding general linear codes, represents one of the most promising families of alternatives. HQC and BIKE are prominent examples within this category, prized for their strong mathematical foundations and efficiency.

However, transitioning these mathematical constructs into secure real-world hardware requires robust protection against physical implementation attacks, commonly known as side-channel and fault injection attacks. Fault injection involves intentionally disrupting the normal operation of a physical computing device—often by altering voltage, clock signals, or using precision lasers—to induce computational errors that can reveal secret cryptographic keys.

Until now, security assessments of code-based KEMs have predominantly concentrated on faults directed at the Fujisaki-Okamoto transform. This cryptographic transformation is a standard design pattern used to convert public-key encryption schemes into secure KEMs, providing protection against chosen-ciphertext attacks. Because the transform acts as a gatekeeper during decapsulation, verifying the integrity of ciphertexts before revealing shared secrets, it has naturally become the focal point for security evaluations and countermeasures.

The new research demonstrates that this narrow focus leaves a broader attack surface unprotected. The team successfully engineered fault injection attacks against both BIKE and HQC that operate entirely beyond the Fujisaki-Okamoto verification layer. Instead, the researchers targeted less obvious instructions deep within the decapsulation process, bypassing standard verification safeguards and exploiting internal operational behavior.

To achieve this, the researchers developed a general, systematic approach to identify effective fault locations by closely analyzing decoder behavior under perturbed physical conditions. By observing how the decoding algorithms react to localized disturbances, the team was able to pinpoint vulnerable instructions that yield exploitable internal errors without causing the system to crash entirely.

The practicality of these theoretical attacks was validated through rigorous physical experiments. The researchers implemented the cryptographic schemes on an STM32H7 microcontroller and utilized laser fault injection techniques to introduce precise, localized thermal or optical disturbances into the silicon die. The experimental results demonstrated high repeatability, confirming that the identified vulnerabilities are not merely theoretical artifacts but pose a genuine risk to physical implementations of HQC and BIKE.

According to the study, the proposed attacks successfully achieve full cryptographic key recovery using only valid ciphertexts under NIST Level 1 security parameters. Specifically, the attack against HQC required 17,392 decapsulation queries to extract the secret key, while the attack against BIKE required approximately 3 million queries. Although the number of queries differs between the two schemes due to their underlying algebraic structures and decoder designs, both figures fall well within the realm of feasibility for automated physical testing environments.

The implications of these findings extend beyond the specific algorithms tested. By proving that fault injection can successfully target internal decapsulation instructions outside the Fujisaki-Okamoto transform, the research highlights a significant blind spot in current engineering practices for post-quantum cryptography. As hardware manufacturers and cryptographers race to deploy quantum-resistant algorithms into microcontrollers, smart cards, and embedded systems, safeguarding these less visible computational steps will become crucial.

The authors note that their work provides a foundational framework and methodology for more efficient fault attack analyses in future research, which will ultimately aid the cryptographic community in designing comprehensive countermeasures and hardening next-generation encryption standards against physical tampering.