Paper 2026/071

Codeword Masking Can Be Harmful Under Replay Attacks on HQC

Abstract

HQC, selected by NIST for standardisation in 2025, was recently shown vulnerable to an attack that replays a decapsulation to recover v - uy Maillet et al., (CRYPTO 2025), against which codeword masking was proposed as the countermeasure. We show the countermeasure backfires: under codeword masking the random share is itself easily recovered, and that share injects the cross-replay input diversity that, far from defending, assists the attack. We establish this in three steps. (1) We identify a new leakage venue in the Reed--Muller encoder re-executed during decapsulation; building on an idea of Goy et al.(WCC 2022), we then use HQC's own error-correcting decoder, provisioned for a low decryption-failure rate, as a side-channel budget, recovering the message --- and hence the shared key --- from a single trace with only 80 profiling traces. (2) We extend the v - uy replay attack to a broader power-leakage hypothesis and replace signal averaging with per-trace soft voting, raising per-bit accuracy from 0.747 to 0.933; yet because each leakage sample conflates several bits, bit-exact recovery of a 384-bit block still succeeds with probability only 7x10^{-13}. (3) Combining (1) and (2), however, the masked setting makes the attack succeed: the recovered per-replay shares marginalise the conflation and lift block recovery to 100% at R500 replays. Codeword masking thus turns from a defence into an attack amplifier --- a hazard for any single-trace recovery setting where the same input is re-encoded under per-decapsulation random shares.