Post-Quantum Key Encapsulation Mechanisms: A Comparative Review of ML-KEM, BIKE, and HQC
Abstract
Large-scale quantum computers will fundamentally compromise public-key cryptosystems based on integer factorization and the discrete logarithm problem. The National Institute of Standards and Technology (NIST) standardized ML-KEM (FIPS 203, August 2024) and selected HQC (March 2025) as a code-based backup Key Encapsulation Mechanism (KEM). This paper presents a structured comparative analysis of ML-KEM, BIKE (Bit Flipping Key Encapsulation), and HQC (Hamming Quasi-Cyclic) across six dimensions: mathematical foundations, key and ciphertext sizes, computational performance with explicit instruction-set architecture (ISA) attribution, quantitative security margins, side-channel resistance, and TLS 1.3 handshake overhead. A phased migration roadmap is also provided. ML-KEM delivers compact key material, formally proven Indistinguishability under Adaptive Chosen Ciphertext Attack (IND-CCA2) security, and balanced performance, making it the appropriate primary KEM for general deployment. HQC supplies a formally bounded Decryption Failure Rate (DFR) and mathematical independence from lattice assumptions, establishing it as a sound standardized backup. BIKE offers competitive encapsulation speed but relies on an empirically bounded, rather than formally proven, DFR, constituting a residual security gap that precluded its standardization.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Recovering the secret s from the public key requires solving the M-LWE problem, which stays hard even for quantum adversaries.
“Recovering s from the public key requires solving the M-LWE problem, which stays hard even for quantum adversaries [61].”
From A hybrid encryption algorithm based on AES and Kyber for secure image protection in the post-quantum era (2026) · cites this paper as [61]
Key security relies on the hardness of the Learning with Errors (LWE) problem, which remains computationally infeasible even on a quantum computer.
“Key security relies on the hardness of the Learning with Errors (LWE) problem, and it will remain computationally infeasible even on a quantum computer”
From A hybrid encryption algorithm based on AES and Kyber for secure image protection in the post-quantum era (2026) · cites this paper as [61]
Cites
A fast quantum mechanical algorithm for database search
Grover, L. K. (1996) · Proceedings of the twenty-eighth annual ACM symposium on Theory of computing - STOC '96 · doi:10.1145/237814.237866 · Cited by 8,830 · see citing works
Algorithms for quantum computation: discrete logarithms and factoring
Shor, P. W. (2002) · Proceedings 35th Annual Symposium on Foundations of Computer Science · doi:10.1109/sfcs.1994.365700 · Cited by 8,713 · see citing works
On lattices, learning with errors, random linear codes, and cryptography
Regev, O. (2009) · Journal of the ACM · doi:10.1145/1568318.1568324 · Cited by 2,315 · see citing works
Bernstein, D. J., & Lange, T. (2017) · Nature · doi:10.1038/nature23461 · Cited by 1,242 · see citing works
CRYSTALS - Kyber: A CCA-Secure Module-Lattice-Based KEM
Bos, J., Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schanck, J. M., Schwabe, P., Seiler, G., & Stehle, D. (2018) · 2018 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2018.00032 · Cited by 1,192 · see citing works
On Ideal Lattices and Learning with Errors over Rings
Lyubashevsky, V., Peikert, C., & Regev, O. (2013) · Journal of the ACM · doi:10.1145/2535925 · Cited by 842 · see citing works
MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes
Misoczki, R., Tillich, J.-P., Sendrier, N., & Barreto, P. S. L. M. (2013) · 2013 IEEE International Symposium on Information Theory · doi:10.1109/isit.2013.6620590 · Cited by 420 · see citing works
An Efficient Key Recovery Attack on SIDH
Castryck, W., & Decru, T. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30589-4_15 · Cited by 315 · see citing works
Post-quantum Key Exchange for the Internet and the Open Quantum Safe Project
Stebila, D., & Mosca, M. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-69453-5_2 · Cited by 232 · see citing works
Benchmarking Post-quantum Cryptography in TLS
Paquin, C., Stebila, D., & Tamvada, G. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-44223-1_5 · Cited by 179 · see citing works
Efficient Encryption From Random Quasi-Cyclic Codes
Aguilar-Melchor, C., Blazy, O., Deneuville, J.-C., Gaborit, P., & Zemor, G. (2018) · IEEE Transactions on Information Theory · doi:10.1109/tit.2018.2804444 · Cited by 122 · see citing works
Curse of Re-encryption: A Generic Power/EM Analysis on Post-Quantum KEMs
Ueno, R., Xagawa, K., Tanaka, Y., Ito, A., Takahashi, J., & Homma, N. (2021) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2022.i1.296-322 · Cited by 107 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Singh, P., Hasija, T., Ramkumar, K. R., & Kanika (2026) · Discover Computing · doi:10.1007/s10791-026-10577-0
“The recipient recovers m using the private key s, since 𝑣𝑣 𝑣 𝑣𝑣 𝑇𝑇 𝑢𝑢 ⌈ 𝑞𝑞 the 2⌋ Recovering s from public key requires solving the M-LWE problem, which stays hard even for quantum adversaries [61].”
- Authors
- Reazaei, P., Rashid, A. S. K., Mand, A. A., & Saberikamarposhti, M.
- Affiliations
- Howard University (US)
- University of Technology Malaysia (MY)
- Sunway University (MY)
- Venue
- 2026 22nd IEEE International Colloquium on Signal Processing & Its Applications (CSPA)
- Publisher
- IEEE
- Published
- 2026-05-01
- Pages
- 342-347
- OpenAlex
- W7161823971
- Cited by
- 1
- References
- 12
- Citations by year
- 2026: 1
- FWCI
- 8.94
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Colloquium on Signal Processing & Its Applications (CSPA) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
- Keywords
- post-quantum cryptography, key encapsulation mechanism, ML-KEM, BIKE, HQC, code-based cryptography, lattice-based cryptography, NIST standardization, IND-CCA2 security, side-channel attack resistance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
