Reportshash-26 · Constant-time review

The Hash Function CHIME (hash-26)

CandidateThe Hash Function CHIME
FamilySymmetric (sponge and feed-forward sponge)
ArchiveCHIME.zip (SHA-256: 3368eff8f86744eefba82825c11990a3b4d914e014ff184324ab3cb9af88b3a4)

hash-26-1: An invariant subspace reduces CHIME collision bounds to 64 and 224 bits

SeverityHigh
Scopedesign
StatusConfirmed
AffectedSubmitted CHIME-512 and CHIME-1024 specifications and implementations
DiscoveryModerate
ExploitationApproximately 2^64 and 2^224 evaluations; no collision has been computed
CreditCryptanalysts001 (ISCAS) yufei2021@iscas.ac.cn
Date2026-09-22

Original source: CryptHashForum report

In the submitted permutation, each 256-bit array remains in the repeated-word form (x,x,x,x): every layer preserves it and each round constant repeats one 64-bit word four times. This gives a 384-dimensional invariant subspace for the complete nonlinear, full-round permutation.

For CHIME-512, a 2^240-message family remains in the subspace through ordinary padding, while its digest contains only two independent 64-bit words. Sampling this family therefore gives a classical collision upper bound of about 2^64, rather than the claimed 256 bits. For CHIME-1024, eight controlled blocks encode 2^512 distinct messages but reach at most 2^448 pre-final states; common padding and finalization preserve equality, giving an upper bound of about 2^224, rather than 512 bits. These are proof-level squeeze bounds, not computed collisions.

The submission team subsequently published an erratum changing the repeated round constants to word-dependent constants. That acknowledges and removes this particular invariant in a revised design; the archived Round 1 submission remains affected.

Further analysis: Yufei Yuan et al., Structural Analysis of Seven Hash Functions Submitted to the NGCC, Section 5 (2026-09-23), gives a greater-than-0.39 collision probability within 2^64 evaluations for CHIME-512. The paper does not cover this report's CHIME-1024 extension.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

The local check reproduces the reporters' 126-byte CHIME-512 invariant-state witness and digest and recomputes both dimension bounds:

make -C hash-26 reproduce