Reports › hash-17
MasterCube (hash-17)
| Candidate | MasterCube |
|---|---|
| Family | Symmetric (sponge, AndRX permutation) |
| Scope | Reference implementation, all three parameter sets |
| Severity | Critical |
| Discovery | Trivial |
| Exploitation | Trivial |
| Date | 2026-09-21 |
| Credit | Markku-Juhani O. Saarinen markku-juhani.saarinen@tuni.fi, with AI assistance |
| Archive | MasterCube.zip (SHA-256: 1f9773b8ece90152a6a9adc632a7112c9afc670a5d28b7f1e9ac111e5eea8f13) |
Trivial collisions at every rate boundary
The following collision was verified against MasterCube-512:
- Input 1: 958 one bits, encoded in 120 bytes of
ffwith length 958 bits - Input 2: 959 one bits, encoded in the same buffer with length 959 bits
Both produce:
847a067d6eb9078d5c3ce3e3f08fbfd3a1488eb6e89909144db1a76d5fcb9a097fef21b4927bb6fe0a1bb2769ef0f249734550c1e8acfa0023a1281d12131bf6
The implementation attempts to apply pad10*1 in a single rate block. When the message length is r-1 mod r, only one bit remains. The opening and closing delimiter bits are ORed into the same position instead of emitting the additional block required by the specification.
Consequently, for any prefix P of length r-2 mod r, the implementation gives H(P) = H(P || 1). The same defect was reproduced at 702/703 bits for MasterCube-768 and 446/447 bits for MasterCube-1024. It directly violates the claimed 256-, 384-, and 512-bit collision strengths and is an implementation error rather than an attack on the specified permutation.
Reproduction
security/ngcc_security hash-17/lib/libMasterCube-512.so hash-zero-padding