Reports › hash-24 · Constant-time review

QuantaSylva Hash (QSH) (hash-24)

hash-24-1: Full-round core permutation has a one-query invariant-subspace distinguisher

Original source: CryptHashForum report

As reported on the CryptHash mailing list, the full ChaCha Bahru permutation commutes with translation of the x2 coordinate. Consequently the subspace in which the four words differing only in x2 are equal is invariant through every round and the final layer. It has dimension 16w inside the 64w-bit state. One evaluation on a chosen member therefore distinguishes the permutation from random with advantage 1 - 2^-1536 for QSH-512 and 1 - 2^-3072 for QSH-768/1024.

This is a structural distinguisher on the independently specified core permutation, not a collision, preimage, or distinguisher through the QSH hash interface. The fixed IV and compression-function injection do not give an attacker a chosen full-state permutation input, and no whole-hash attack is presently known.

Further analysis: Yufei Yuan et al., Structural Analysis of Seven Hash Functions Submitted to the NGCC, Section 7 (2026-09-23), proves the invariant and likewise does not claim a whole-hash attack.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

The witness calls the submitted QSH-512 permutation on the mailing-list input, checks all 48 defining equalities, and also checks the published exact output:

cc -O2 -std=c99 -Ihash-24/QSH/Implementations/03_Implementations/1_Reference_Implementation/QSH-512 \
  hash-24/reproduce_invariant.c -o /tmp/qsh-invariant
/tmp/qsh-invariant

Expected output:

CONFIRMED: full QSH-512 permutation preserves the 512-bit subspace
random-permutation probability: 2^-1536