← All Research
[Research Publication — 2026]

We Found a 4-Year-Old Security Hole in Post-Quantum Encryption — and a Fix That Also Makes It 3× Faster

Post-quantum cryptography is the new generation of encryption designed to stay secure even against future quantum computers. We discovered that a popular compiler tool has been silently undermining it since 2022 — on every major operating system, across every version — and that a single configuration change fixes the problem entirely.

Author Bader Alissaei
Date April 2026
Topic Post-Quantum Cryptography · Compilers · Side Channels

What We Found

No cryptography background needed to understand this

01

The problem with modern encryption

Encryption only works if an attacker cannot figure out your secret key by watching how long operations take. If the code runs slightly faster or slower depending on parts of the key, a patient attacker can measure those differences and reconstruct the key — no supercomputer needed.

02

The source code was safe. The compiled program wasn't.

The developers of HQC — one of the three post-quantum encryption algorithms chosen by the US government (NIST) — wrote their code carefully to avoid timing differences. It passed every security check. But a compiler called Clang (software that translates human-written code into a program a computer can actually run) quietly "optimised" it in a way that reintroduced exactly the timing variation the developers had worked to remove.

03

This has been happening for 4 years

Every version of Clang released since June 2022 — including the current version — has this behaviour. On Linux. On Windows. At every standard optimisation setting. Anyone who compiled HQC with Clang during this time has a vulnerable binary, without knowing it.

04

The fix is one line — and it makes the code faster

Adding a single flag to the build command completely eliminates the vulnerability. Surprisingly, it also makes the encryption code run more than 3 times faster, because the "optimisation" Clang was applying was actually slowing things down by forcing the processor to repeatedly guess wrong.

// The headline finding

Inside Clang there is a component called x86-cmov-converter — an internal optimiser that looks at certain safe, branchless instructions and decides "a conditional jump here would be faster." For normal code it is sometimes right. For secret cryptographic data it is always wrong, because the processor cannot predict which way the jump will go (the outcome depends on a secret it has never seen), so it guesses wrong roughly half the time. Each wrong guess wastes ~15 processor cycles. Across one encryption operation that adds up to millions of wasted cycles — making the vulnerable binary over 3× slower than the fixed one. Disabling this component with a single build flag restores both security and performance in one move.

// How safe source code becomes a leaky binary — and what the fix does
Unpatched
Source Code
constant-time ✓
LLVM IR
select (safe)
x86-cmov-converter
⚠ rewrites to branch
cmp + jne
branch on secret ⚠

With fix
Source Code
constant-time ✓
LLVM IR
select (safe)
x86-cmov-converter
disabled by flag
cmov
constant-time ✓

The Numbers

9
Clang versions tested
(14.0.6 → 22.1.2)
20
Compiler/platform
combinations — all leaky
4 yrs
Scope of the vulnerability
in released Clang builds
1000×
Statistical leak signal
vs. threshold (dudect)
3.07×
Speed improvement
from the fix
// Encryption time per operation — HQC-128 (lower is faster)
Clang (unpatched)
1,341,800 ns
LEAKY
GCC (reference)
877,300 ns
SAFE
Clang (fixed)
437,567 ns
SAFE + FASTEST

Disabling x86-cmov-converter eliminates the vulnerability and makes the code 3.07× faster than unpatched Clang and 2× faster than GCC — because the "optimisation" was causing the processor to mispredict branches on secret data, wasting millions of cycles per operation.

If you build HQC with Clang, add this to your build flags today

This flag works with every Clang version from 14 onwards, requires no source code changes, and is safe to add unconditionally. It is a no-op with GCC.

CFLAGS="-O3 -mllvm -x86-cmov-converter=false"

Coordinated disclosure filed with the open-source maintainers: PQClean #608  ·  liboqs #2402

Cite This Work

// BibTeX @misc{alissaei2026compilingvulnerabilities,
  author       = {Bader Alissaei},
  title        = {Compiling Vulnerabilities: An Empirical Study of
                   Compiler-Induced Constant-Time Violations in
                   HQC, BIKE, and Classic McEliece},
  year         = {2026},
}