Reports › hash-27 · Constant-time review
Vedak (hash-27)
| Candidate | Vedak |
|---|---|
| Family | Symmetric (sponge hash) |
| Archive | Vedak.zip (SHA-256: dc1fa5612337e0aae3e236606c3e46322a513c21b1550ac8f20753790892637e) |
hash-27-1: Secret state indexes an eight-bit substitution table
| Severity | Medium |
|---|---|
| Scope | side-channel |
| Status | Confirmed |
| Affected | Reference Vedak-512/768/1024 |
| Discovery | Trivial |
| Exploitation | Cache side-channel dependent |
| Credit | Markku-Juhani O. Saarinen markku-juhani.saarinen@tuni.fi, with AI assistance |
| Date | 2026-09-23 |
Every apply_S call reads the 256-byte S_BOX_8 at eight indices from each evolving state word (CryptHash_AlgorithmInstance.c:167-180 in Vedak-512, :165-178 in Vedak-768/1024); the table is declared at :57 in Vedak-512. These accesses select cache lines according to secret message-dependent state. The separate source-level if (bit) in message copying is not part of this finding: GCC -O2 makes it branchless. No preimage-recovery exploit is claimed. See constant_time.md.
Reproducing
Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).
Inspect apply_S in any reference variant and its call from vedak_p40 (CryptHash_AlgorithmInstance.c:243 in Vedak-512, :241 in Vedak-768/1024); the S-box index is computed from state bytes rather than a public loop index.