X-Wing+ — Extended KEM Combiner with HQC
Lux extension of the IETF X-Wing KEM combiner to a three-family construction adding HQC (code-based) on top of X25519 (classical) and ML-KEM-768 (lattice).
Implementation status (code-audited 2026-07-03): DESIGN — NOT YET IMPLEMENTED No 3-family combiner exists; crypto/hqc ships as a standalone KEM only.
Abstract
X-Wing+ is the Lux three-family KEM combiner extending IETF X-Wing
(LP-4920) with HQC (LP-4600), the NIST PQC Round 4 code-based
KEM. The combined shared secret is secure as long as at least
one of three structurally distinct components remains unbroken:
X25519 (classical elliptic-curve DLP), ML-KEM-768 (lattice
MLWE), or HQC (code-based syndrome-decoding). This hedge is the
strongest KEM hardness assumption Lux currently ships, and is the
default for long-lived key-establishment contexts that cannot be
re-negotiated (e.g., sealed encrypted-archive sessions, sovereign
data escrow). The combiner construction reuses X-Wing's
"XOR-then-PRF" pattern with the DST tag \.//+ (one byte added
to distinguish from upstream X-Wing) and cSHAKE128 KDF. Sizes:
combined public key 5,697 B (32 + 1,184 + 4,481), combined
ciphertext 5,601 B (32 + 1,088 + 4,481 for HQC-128 tier).
Reference implementation
- Primitive:
luxfi/crypto/kem/xwing-plus(planned) - Components: LP-4920 (X-Wing base), LP-4600 (HQC), LP-4318 (ML-KEM)
- DST:
\.//+
Copyright
Copyright and related rights waived via CC0.