Reports › hash-32 · Constant-time review
ZC-EDMC (hash-32)
| Candidate | ZC-EDMC |
|---|---|
| Family | Symmetric (sponge) |
| Archive | ZC-EDMC.zip (SHA-256: 235157f178c0ec885dad4062ee232cdc0d16e95474f05c6f93038fd951ca3712) |
hash-32-1: The specified and implemented ZC-EDMC mappings differ
| Severity | Low |
|---|---|
| Scope | design |
| Status | Confirmed |
| Affected | All six ZC-EDMC parameter sets |
| Discovery | Trivial |
| Exploitation | Trivial |
| Credit | Cryptanalysts001, Institute of Software, Chinese Academy of Sciences yufei2021@iscas.ac.cn |
| Date | 2026-09-22 |
Original source: CryptHashForum report
The construction prose and Algorithm 3 define the compression mapping with two different six-round halves, h(g(X) xor (0^r || X_c)). A displayed equation instead uses h(h(X) xor ...), and the reference implementation invokes the same last-six-round function twice. It therefore implements the displayed equation rather than Algorithm 3.
The submitted permutation constants introduce a second deterministic mismatch: rounds 5--7 and 9--11 of the code's twelve-round schedule are permuted relative to the specification table. The submitters independently modeled the code schedule and reproduced its KATs, and report that changing the inner call from h to g changes all 22 tested digests for each of the six instances. This is an interoperability and analysis-target defect, not a demonstrated collision or preimage attack.
Reproducing
Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).
The local checker verifies both calls in every reference instance and the exact submitted constant schedule:
make -C hash-32 reproduce-forum