The U.S. National Institute of Standards and Technology (NIST) has taken another decisive step in preparing for the post-quantum era. In a move that reinforces the future of encryption, NIST has selected a fifth algorithm, called HQC, to serve as a backup for post-quantum encryption. This new standard adds an essential layer of security to a world that is rapidly moving toward quantum computing.
HQC as a Backup
The newly chosen HQC algorithm (Hamming Quasi-Cyclic) will not replace ML-KEM, the main encryption standard finalized by NIST in 2024. Instead, HQC is designed to serve as a secondary line of defense, should quantum computers someday find vulnerabilities in ML-KEM. This decision shows how seriously the cybersecurity community is taking the unpredictable pace of quantum innovation.
HQC and ML-KEM differ in their mathematical foundations. While ML-KEM is based on structured lattices, HQC relies on error-correcting codes—a trusted concept in information theory for decades. This distinction means that HQC offers a fundamentally different cryptographic structure, helping diversify the tools available to protect digital data. If one method proves vulnerable, the other could continue to provide security.
According to Dustin Moody, lead mathematician at NIST’s Post-Quantum Cryptography project, the selection of HQC is a proactive safeguard. “We want to have a backup standard that is based on a different math approach than ML-KEM,” he explained.
Applications and Limitations
In practical terms, HQC will offer protection for both data in transit and data at rest. From internet traffic and cloud storage to medical records and government communications, the encryption built around HQC is meant to secure the world’s most sensitive information from future quantum threats.
That said, HQC does come with trade-offs. It is a longer algorithm and requires more computational power than ML-KEM. But its simplicity, clean design, and well-understood structure made it the strongest candidate among four algorithms studied during NIST’s fourth round of evaluation.
What Comes Next for HQC
The HQC algorithm will eventually become a standardized option under the Post-Quantum Cryptography project. NIST expects to release a draft of the standard for public comment within the next year, followed by a finalized version in 2027. Once published, it will join ML-KEM and other already standardized algorithms like FIPS 203, 204, and 205.
Both HQC and ML-KEM are considered KEMs—key encapsulation mechanisms. These protocols are essential for initiating secure communication between two parties over public networks. In February 2025, NIST released draft guidance for implementing KEMs, offering definitions, best practices, and applications in its Special Publication 800-227.
With HQC’s selection, NIST continues to strengthen the foundation for post-quantum security. For companies like Decent Cybersecurity, this new standard highlights the importance of staying agile and diversified when preparing for the next generation of cyber threats.
Decent Cybersecurity continues to support businesses, government entities, and infrastructure providers in adopting these new encryption standards. Our expertise in quantum-safe security allows us to provide tailored solutions that align with the latest advancements.
For expert consultation on post-quantum encryption, contact us at [email protected].
