ngcc.dev
Symmetric cryptography survey
The NGCC public-key submissions were asked to use the ICCS placeholder functions pseudohash (SM3/HMAC-SM3), pseudoXOF (KDF-SM3) and sm3hash for hashing, and the ICCS SM3 DRNG for randomness, so that the selected NGCC hash can later be substituted. This survey records which reference implementations do so, which bypass the helpers with their own primitives, and how much of each operation the helpers take.
Totals: 67 ICCS-only, 7 bypass, 6 mixed, 4 instance-dependent.
Evidence: call-graph reachability from the exported API in the harness-built libraries, object-level constant scans (Keccak, SHA-2, SM3, AES, SM4, ChaCha), and source reading for candidates without a harness build. A primitive that is compiled but unreachable is not counted.
The last column is measured on system x86_1 (Intel Core i7-12700 (Alder Lake), one performance core, turbo off, fixed 2.1 GHz, SMT off); see its summary.
| id | algorithm | verdict | notes | largest hash share on x86_1 (op) |
|---|---|---|---|---|
| kem-01 | Aigis-Enc+ | ICCS-only | own fips202.c compiled but unreachable from the API | 39% (Aigis-enc3 enc) |
| kem-02 | Amoeba | ICCS-only | 74% (Amoeba128 keygen) | |
| kem-03 | BAG-Loong | ICCS-only | loong_hash_tagged_sm3_256 wraps sm3hash |
79% (BAG-Loong-128 enc) |
| kem-04 | BAG-Piglet | ICCS-only | *_using_shake names parse pseudoXOF output; AES-256-CTR dead; DRNG only with -DBAG_PIGLET_KAT |
56% (bag_piglet_512 keygen) |
| kem-05 | BIKE-MLThre | mixed | hash/XOF via ICCS; seeds from NIST AES-256-CTR-DRBG (OpenSSL) only with -DNIST_RAND, otherwise libc rand() | 1.2% (BIKE_v2_128 enc) |
| kem-06 | BRA | ICCS-only | pseudohash for G/H; seed expansion via per-seed ICCS DRNG instances; XKCP Keccak dead | 4.5% (BRA-128 enc) |
| kem-07 | BRQC | ICCS-only | pseudohash for G/H; seed expansion via per-seed ICCS DRNG instances; XKCP Keccak dead | 5.3% (BRQC-128 enc) |
| kem-08 | BW-KEM | ICCS-only | optimized AVX2 auxfunc.c adds an SM3 counter-block fast path | 78% (BW_KEM_C512 enc) |
| kem-09 | CheetahKEM | ICCS-only | 83% (Cheetah512 keygen) | |
| kem-10 | C-Multi-UR-AG | ICCS-only | own fips202.c compiled but unreachable from the API | 2.9% (CMultiURAG-256 enc) |
| kem-11 | COMPASS-KEM | ICCS-only | shake* names are shims over pseudoXOF |
97% (COMPASS-KEM-256 keygen) |
| kem-12 | CTL Algorithm | ICCS-only | sha3.c shim has no permutation and is unused | 12% (CTL-257-512 enc) |
| kem-13 | DKEM (Ding Key Encapsulation) | ICCS-only | default DKE_HASH=0; own SM3/HMAC compiled but unreachable; DKE_HASH=2 would switch to SHAKE | 82% (DKEM-512 keygen) |
| kem-14 | DTRU | ICCS-only | 33% (DTRU-768 enc) | |
| kem-15 | FLIT | ICCS-only | 52% (FLIT128_REF enc) | |
| kem-16 | HARE | ICCS-only | pseudoXOF only (recomputes prefix per call); lives under _shared/ | 3.0% (HARE-128-kr keygen) |
| kem-17 | Hybrid Equivalent Punctured and Quasi-Cyclic | ICCS-only | never calls the DRNG: zero-initialised PRNG (known kem-17-1/-3) | 89% (hep-qc-1 dec) |
| kem-18 | LoongKEM | ICCS-only | 87% (Loong512 keygen) | |
| kem-19 | Lore | instance-dependent | Lore-SM3: ICCS-only; Lore-SHAKE: own FIPS 202 (bypass); AVX2/NEON SIMD SM3 in auxfunc | 73% (Lore-SM3-L1 keygen) |
| kem-20 | MAMBA-Frost | mixed | all SHAKE calls are pseudoXOF shims; matrix A via own AES-128 with -D_AES128_FOR_A_ | 3.8% (MAMBA-Frost-128 dec) |
| kem-21 | MAMBA-Viper | ICCS-only | shake* names are shims over pseudoXOF |
48% (MAMBA-Viper-128 enc) |
| kem-22 | Mithril | ICCS-only | 40% (Mithril-128 keygen) | |
| kem-23 | Mito | ICCS-only | 1.7% (Mito-2-E-128 dec) | |
| kem-24 | MORNING-Scabbard | ICCS-only | 70% (scabbard128 keygen) | |
| kem-25 | NEV | ICCS-only | with -DUSE_ICCS (SHA3 build selectable) | 69% (NEV_2048_3329_ICCS enc) |
| kem-26 | NSS-HQC | bypass | own inline Keccak (SHA3-512, SHAKE256) for everything; DRNG for randomness | 0.0% (HQC-128 dec) |
| kem-27 | NTRE Key Encapsulation Mechanism | ICCS-only | 49% (NTRE-128 enc) | |
| kem-28 | OAEP-NTRU | ICCS-only | 66% (OAEP-NTRU-2592 enc) | |
| kem-29 | Polar-KEM | ICCS-only | 98% (PolarKEM-512 keygen) | |
| kem-30 | PolarLAC | ICCS-only | default BIT_USE_SHAKE=0 | 73% (POLARLAC-512 enc) |
| kem-31 | QIMEN-PIKE | bypass | own SM3 + counter XOF (pike_hash.c) for G, KDF and streams; DRNG only | 0.0% (NGCC-1 dec) |
| kem-32 | Quasi-Cyclic Twisted McEliece Key Encapsulation Mechanism | bypass | own SHAKE256 for session key/keygen expansion; OpenSSL AES-256-CTR-DRBG seeded by the ICCS DRNG; auxfunc not linked | 0.0% (QCTM128 dec) |
| kem-33 | QUBE | ICCS-only | 62% (qube-128 enc) | |
| kem-34 | Rudraksh2 | ICCS-only | 96% (lwekem512 enc) | |
| kem-35 | Scloud+ | instance-dependent | SM3 sets: private modified copy of auxfunc (official not linked); AES/SHAKE sets: own AES/Keccak (bypass); benchmark pilot uses SHAKE | 93% (Scloudplus-192-SM3-packed10 keygen) |
| kem-36 | TRIKE | ICCS-only | 4.7% (TRIKE-2 enc) | |
| kem-37 | TriQ-KEM | ICCS-only | 12% (TriQ-KEM-128 keygen) | |
| kem-38 | UVW Key Encapsulation Mechanism | ICCS-only | 14% (UVW-KEM-128 enc) | |
| kem-39 | Weaver | ICCS-only | grep hits for AES/Keccak/OpenSSL are not reachable in the built library | 82% (WeaverKEM-128 keygen) |
| kem-40 | YuanYang.KEM | ICCS-only | 42% (yuanyang-512 enc) | |
| kem-41 | ZEN | ICCS-only | 67% (ZEN_128 enc) | |
| kex-01 | ADKEX (Authenticated Ding Key Exchange) | ICCS-only | default DKE_HASH=0; own SM3/HMAC compiled but unreachable; DKE_HASH=2 would switch to SHAKE | 81% (ADKEX-512 exchange) |
| kex-02 | AFS-KEX | ICCS-only | optimized AVX2 auxfunc.c adds an SM3 counter-block fast path | 76% (AFS_KEX_C512 exchange) |
| kex-03 | CreTAKE | ICCS-only | PolarLAC/ZEN/BiT components; Keccak only if BIT_USE_SHAKE=1 | 78% (CreTAKE-S2S-BiT512-ePLAC512 exchange) |
| kex-04 | DKEX (Ding Key Exchange) | mixed | KEX core via ICCS; embedded ML-DSA uses its own SHAKE | 36% (DKEX-512 exchange) |
| kex-05 | Loom | ICCS-only | grep hits for AES/Keccak/OpenSSL are not reachable in the built library | 6.2% (LoomKEX-512 exchange) |
| kex-06 | MAMBA-NIKE | bypass | SHAKE128/256 + ChaCha20; DRNG only with -DKAT_BUILD, otherwise /dev/urandom | 0.0% (MAMBA-NIKE-128 exchange) |
| kex-07 | NEV-AKE | ICCS-only | own fips202.c compiled but unreachable | 55% (NEV_AKE_2048_769 exchange) |
| kex-08 | NIIKE | bypass | no hash or KDF at all: raw j-invariant (known kex-08-1) | 0.0% (NIIKE-lv128 exchange) |
| kex-09 | TriQ-KEX | ICCS-only | 7.0% (TriQ-KEX-128 exchange) | |
| sign-01 | Aigis-Sig+ | ICCS-only | own fips202.c compiled but unreachable from the API | 64% (Aigis-sig1 sign) |
| sign-02 | BIT: Bimodal Triangular distribution based lattice signatures | ICCS-only | own fips202.c compiled but unreachable (BIT_USE_SHAKE=0) | 88% (BiT-512 keygen) |
| sign-03 | CEDRUS+C | ICCS-only | 99% (CEDRUSC-384s keygen) | |
| sign-04 | CEDRUSÉ‘ | ICCS-only | 99% (CEDRUSALPHA-384f keygen) | |
| sign-05 | Chinith | mixed | random oracles via ICCS; seed-tree/VOLE PRG via SM4 / Ballet / Vistrutah | 36% (sm4th_em_d2_128s_tight sign) |
| sign-06 | COMPASS-SIG | ICCS-only | shake* names are shims over pseudoXOF |
95% (COMPASS-SIG-256 keygen) |
| sign-07 | CS | ICCS-only | 62% (CS-512 sign) | |
| sign-08 | DARTS | ICCS-only | x4 shake names loop over the ICCS XOF | 88% (DARTS128 sign) |
| sign-09 | DOVE | ICCS-only | 63% (dove_pkc_skc_512 verify) | |
| sign-10 | Facto-DSA | ICCS-only | 88% (Facto-DSA-512 verify) | |
| sign-11 | FlexTree | ICCS-only | 99% (Flextree-384f keygen) | |
| sign-12 | Galas Signature Scheme | ICCS-only | 46% (Galas-256S verify) | |
| sign-13 | GreatWall Signature Algorithm | bypass | own XKCP Keccak + AES-CTR PRGs; no auxfunc.c shipped | 0.0% (GreatWall128f keygen) |
| sign-14 | Lynxer | mixed | with -DXOF_PSEUDO (as the KATs need): oracles via pseudoXOF, PRG via AES/Rijndael/SHACAL-2; source default is own Keccak (bypass) | 99% (Lynxer-512f keygen) |
| sign-15 | MORNING-ATLAS | ICCS-only | 83% (lwrdsa192 keygen) | |
| sign-16 | Octarine | ICCS-only | 60% (Octarine-128 keygen) | |
| sign-17 | OPS Digital Signature Algorithm | ICCS-only | optimized AVX2 auxfunc.c adds sm3x4 / pseudoXOF_4x | 92% (OPSsig-512 keygen) |
| sign-18 | Origami | ICCS-only | shake* names are shims over pseudoXOF |
100% (Origami-512 keygen) |
| sign-19 | Phoenix | instance-dependent | SM3 sets mixed (own SM3 for all tree hashing/PRF, pseudoXOF for digest/indices); SHAKE sets bypass with a SHAKE-based drng.c | 12% (Phoenix-SM3-256s sign) |
| sign-20 | Qing Luan | ICCS-only | builds wide hash and counter XOF on sm3hash, not pseudohash/pseudoXOF | 88% (QingLuan-512 keygen) |
| sign-21 | ReSolveD-É‘ | bypass | Keccak oracles + AES/Rijndael/SHACAL-2 PRGs; pseudoXOF only with -DXOF_PSEUDO (undefined) | 72% (ReSolveD-alpha-512f keygen) |
| sign-22 | Rhyme | instance-dependent | SM3 sets: counter XOF on sm3hash; SHAKE sets: own FIPS 202 (bypass) | 77% (Rhyme-SM3-256 sign) |
| sign-23 | Shuttle | ICCS-only | uses the ICCS SM3 DRBG (init/get_random_number) as its XOF; AVX2/AVX-512 SM3 DRBG in optimized | 0.0% (SHUTTLE-128 keygen) |
| sign-24 | Sigurd | ICCS-only | 62% (Sigurd-512 sign) | |
| sign-25 | SQIsign2D2 | ICCS-only | 17% (SQISign2Dsquare-Level2-eff_uncompressed verify) | |
| sign-26 | SQIsign2D-push1/2 | ICCS-only | iccs/xof_iccs.c glue; NIST SHAKE/AES leftovers unused | 0.0% (SQIsign2D-lvl1 verify) |
| sign-27 | SQIsignTriangle | ICCS-only | shake* names are shims over pseudoXOF |
83% (SQIsignTriangle_lvl6 verify) |
| sign-28 | SYDO | mixed | hashing via pseudoXOF; PRGs via own AES/Rijndael and a BLAKE2s-round cipher | 26% (sydo_512s sign) |
| sign-29 | Tins | ICCS-only | 55% (Tins512 verify) | |
| sign-30 | TRINE | ICCS-only | with -DUSE_ICCS (SHA3 build selectable) | 64% (TRINE-128-Balanced keygen) |
| sign-31 | TSUOV | ICCS-only | 79% (TSUOV_512 sign) | |
| sign-32 | UVW signature | ICCS-only | grep hits for AES/Keccak/OpenSSL are not reachable in the built library | 1.0% (UVW-128 verify) |
| sign-33 | VDOO: Vinegar-Diagonal-Oil-Oil | ICCS-only | 0.3% (vdoo_128 verify) | |
| sign-34 | YuanYang.DSA | ICCS-only | 59% (yuanyang-512 verify) |