Reportshash-27 · Constant-time review

Vedak (hash-27)

CandidateVedak
FamilySymmetric (sponge hash)
ArchiveVedak.zip (SHA-256: dc1fa5612337e0aae3e236606c3e46322a513c21b1550ac8f20753790892637e)

hash-27-1: Secret state indexes an eight-bit substitution table

SeverityMedium
Scopeside-channel
StatusConfirmed
AffectedReference Vedak-512/768/1024
DiscoveryTrivial
ExploitationCache side-channel dependent
CreditMarkku-Juhani O. Saarinen markku-juhani.saarinen@tuni.fi, with AI assistance
Date2026-09-23

Every apply_S call reads the 256-byte S_BOX_8 at eight indices from each evolving state word (CryptHash_AlgorithmInstance.c:167-180 in Vedak-512, :165-178 in Vedak-768/1024); the table is declared at :57 in Vedak-512. These accesses select cache lines according to secret message-dependent state. The separate source-level if (bit) in message copying is not part of this finding: GCC -O2 makes it branchless. No preimage-recovery exploit is claimed. See constant_time.md.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

Inspect apply_S in any reference variant and its call from vedak_p40 (CryptHash_AlgorithmInstance.c:243 in Vedak-512, :241 in Vedak-768/1024); the S-box index is computed from state bytes rather than a public loop index.