Faster post-quantum TLS handshake on x86 IoT gateways with HQC optimizations
Accelerating HQC for Post-Quantum TLS 1.3 on x86 IoT Gateways
Cryptography and Security
Summary
Post-quantum encryption helps protect connected devices like IoT gateways from future quantum computer attacks, but it can slow down connections and use more computing power. The authors improved a specific code-based encryption scheme called HQC by optimizing it for certain Intel processors, making key steps faster and more efficient. Their improvements reduce the time taken for secure handshakes in TLS 1.3 without increasing network traffic much. However, on very slow or limited network links, the size of the messages HQC sends still makes handshakes take longer.
What this means in practice
- •For iot device developers: Implement secure post-quantum TLS connections on x86 gateways with reduced handshake delays using optimized HQC.
- •For network security engineers: Deploy faster HQC-based post-quantum TLS to protect many device connections while managing CPU and latency costs on commodity Intel processors.
Authors
Jihoon Jang, Hyunju Park, Jebin Kim, Seokhie Hong, Suhri Kim
Abstract
Post-quantum TLS at an IoT gateway must protect many device connections without large increases in handshake delay, CPU cost, or network traffic. HQC provides code-based diversity beyond ML-KEM, but its computation and ciphertext sizes can increase these costs. We optimize HQC for x86 processors with AVX2, AVX-512, and the Galois Field New Instructions (GFNI), and integrate the resulting implementations into TLS 1.3. We extend branch-free Toom-Cook/Karatsuba multiplication to AVX-512, accelerate Reed-Solomon decoding with GFNI, improve Reed-Muller decoding, accelerate SHA3-512 and fixed-weight sampling, and port Frobenius additive FFT (FAFFT) multiplication to AVX-512 + GFNI for HQC-5. On an Intel Core i5-1135G7 processor, our AVX2 implementation reduces decapsulation by 11.1-21.5% over the fastest prior AVX2 results. Our AVX-512 implementation reduces key generation by 24.9-29.5%, encapsulation by 10.4-11.1%, and decapsulation by 20.6-26.1% relative to Cabral et al. across the three HQC parameter sets. We evaluate the effects of these implementations on TLS 1.3 handshake latency and server and client CPU costs, as well as the effects of round-trip time (RTT) and bandwidth. In local loopback TLS measurements, our AVX-512 HQC-5 implementation reduces handshake latency from 3.22 ms to 2.92 ms compared with Cabral et al. On a constrained path with 1 Mbit/s bandwidth and an added RTT of 50 ms, the HQC-5 handshake takes 243 ms, compared with 87 ms for ML-KEM-1024. This indicates that HQC public-key and ciphertext sizes, rather than implementation speed, determine the remaining handshake cost on constrained links.