%!TEX root = paper.tex

\section{Conclusion}
\label{sec:conclusion}

In this paper, we present the first timing attack on the HQC encryption scheme.
The attack depends on the choice of the parameter code
$\mathcal{C}$ and its decoder implementation.
We show that the attack is practical, requiring about 400 million decryption timings
to be performed. This makes the use of constant-time decoders for $\mathcal{C}$ mandatory.

We discuss possible countermeasures against this timing attack, with the preferred one being
to use constant-time BCH decoders~\cite{cryptoeprint:2019:155}. However, further study is needed
for the secure and efficient adoption of these decoders.
Other solution would be to use codes for which efficient constant-time decoders are known.
One interesting future work would be to
find alternatives for the code $\mathcal{C}$ that admit compact keys and efficient constant-time decoders,
and for which we can prove negligible decryption failure probability.
