ngcc.dev

ngcc.dev: Security

Candidates follow the official type and candidate-number order. Each finding has a stable xxx-yy-z identifier and its own row. Click it for the full report and reproduction steps.

Reading the table

Separate constant-time reviews cover all candidates at source level; a review without a finding is not a security certification.

361 active findings across 108 reports: 175 implementation, 150 design, 36 side-channel; 4 withdrawn records.

Signatures

identifiercandidate / specfamilyseverityscopeupdatedvulnerability
sign-01Aigis-Sig+ PDFLattice (Module-LWE/SIS, Fiat-Shamir)HighimplementationConfirmed sign-01-1 Trivial signature malleability violates SUF-CMA
HighimplementationConfirmed sign-01-2 Malformed hint counts cause an attacker-controlled stack write
LowimplementationConfirmed sign-01-3 Signature API ignores declared key-buffer lengths
LowimplementationConfirmed sign-01-4 Honest signing writes one polynomial past the mask vector
CriticalimplementationConfirmed sign-01-5 The challenge sampler collapses independent signs to one effective bit
LowdesignConfirmed sign-01-6 The printed abort bound exceeds one, outside the theorems' hypothesis
LowimplementationConfirmed sign-01-7 The external DRBG is used as a KDF
CriticaldesignConfirmed sign-01-8 Short message representatives cap Aigis-Sig+ II and III below their claimed levels
sign-02BiT PDFLattice-basedCriticaldesignConfirmed sign-02-1 A 512-bit unsalted message representative caps forgery security at 256 bits
CriticaldesignConfirmed sign-02-2 A shared bimodal sign leaks an equivalent BiT-128 signing key
sign-03CEDRUS+C PDFHash-based (stateless)CriticalimplementationConfirmed sign-03-1 Hypertree index collapse causes repeated few-time keys
HighdesignConfirmed sign-03-2 FORS+C accumulation gives a below-target fresh-message forgery
sign-04CEDRUS-alpha PDFHash-basedCriticalimplementationConfirmed sign-04-1 The 160-bit WOTS implementation authenticates only 128 bits
CriticalimplementationProbable sign-04-2 FORC chain addresses are truncated to eight bits
LowimplementationConfirmed sign-04-3 Specified and implemented hash instantiations are incompatible
HighdesignConfirmed sign-04-4 FORC accumulation gives below-target fresh-message forgeries
sign-05Chinith PDFSymmetric-key (VOLE-in-the-head) signatureCriticalimplementationConfirmed sign-05-1 The final Fiat–Shamir challenge omits ã0, allowing public-key-only universal forgery
Lowside-channelConfirmed sign-05-2 Signing indexes lookup tables with the secret key
LowdesignConfirmed sign-05-3 The specified opening-rejection retry cannot make progress
CriticaldesignProbable sign-05-4 uBlockith-EM witness misalignment reduces the specified relation to a two-round fixed point
LowimplementationConfirmed sign-05-5 Vistrutith combines three constraint families as one polynomial
LowdesignConfirmed sign-05-6 The specified SM4th-EM relation omits the public output
sign-06COMPASS-SIG PDFLattice-basedCriticalimplementationConfirmed sign-06-1 The implemented message representative caps forgery security at 256 bits
CriticalimplementationConfirmed sign-06-2 The implementation expands the entire key pair from a 256-bit root
LowimplementationConfirmed sign-06-3 Rejected signatures leak heap memory without bound
HighimplementationConfirmed sign-06-4 XOF block replay duplicates every high-level secret polynomial
CriticalimplementationConfirmed sign-06-5 A byte-wide position index and 64 sign bits shrink the 384- and 512-bit challenge spaces below their levels
sign-07CS PDFLattice (Module-LWE, Fiat-Shamir)HighimplementationConfirmed sign-07-1 Trivial signature malleability violates SUF-CMA
CriticaldesignConfirmed sign-07-2 Verifier challenge-sign blindness enables universal forgery
CriticaldesignConfirmed sign-07-3 Compressed signatures enable practical equivalent-key recovery and forgery
CriticalimplementationConfirmed sign-07-4 A missing nonce collapses every secret and error polynomial to one value
sign-08DARTS PDFLattice-basedCriticalimplementationConfirmed sign-08-1 The implemented message representative caps forgery security at 256 bits
CriticaldesignConfirmed sign-08-2 The compression-consistency restart leaks an equivalent DARTS-128 signing key
LowimplementationConfirmed sign-08-3 Reference and AVX2 DARTS expand different public matrices
CriticalimplementationConfirmed sign-08-4 AVX2 DARTS-512 samples its signing secret from 256 seed bits
sign-09DOVE PDFMultivariate (Double Oil-and-Vinegar)MediumdesignConfirmed sign-09-1 The unauthenticated signature salt invalidates the salted-target analysis
sign-10Facto-DSA PDFMultivariate (cubic factorisation)HighdesignLead sign-10-1 The hidden zero subspace has an unpriced algebraic recovery path
CriticaldesignConfirmed sign-10-2 The public key yields a universal signing trapdoor
CriticaldesignConfirmed sign-10-3 Unsalted hash targets permit below-level signature transfers
sign-11FlexTree PDFHash-based (stateless)CriticaldesignConfirmed sign-11-1 PORS counter grinding reduces every claimed security level
InfoevaluationWithdrawn sign-11-2 Withdrawn — SM3 evaluation-mode length extension
CriticaldesignConfirmed sign-11-3 The specified OTS verifier omits its encoding checks
InfoevaluationWithdrawn sign-11-4 Withdrawn — SM3 evaluation-state ceiling
MediumdesignConfirmed sign-11-5 Unchecked PORS padding makes signatures malleable
LowdesignConfirmed sign-11-6 The specified PORS tree reuses leaf hash addresses
LowimplementationConfirmed sign-11-7 The implementation leaves 1 to 4 OTS digest bits unchecked
LowdesignConfirmed sign-11-8 Complementary constant-sum rounding breaks interoperability
sign-12Galas PDFSymmetric (MPC/VOLE-in-the-Head)CriticalimplementationConfirmed sign-12-1 Publicly reproducible signing keys
CriticalimplementationConfirmed sign-12-2 32-bit message-length truncation enables long-message forgeries
LowdesignConfirmed sign-12-3 Same-key S/F signatures recover the Galas secret key
LowimplementationConfirmed sign-12-4 Key generation resets the external DRBG as a seed expander
sign-13GreatWall Signature Algorithm PDFSymmetric-key (VOLE-in-the-head) signatureCriticaldesignConfirmed sign-13-1 SHAKE256 capacity reduces GreatWall-512 forgery cost to about 2^256
LowimplementationConfirmed sign-13-2 Malformed public-key padding aborts verification
sign-14Lynxer PDFVOLE-in-the-head signatureCriticaldesignConfirmed sign-14-1 A degenerate QuickSilver witness gives universal public-key-only forgeries
CriticaldesignConfirmed sign-14-2 A shared TCCR tweak enables one-signature multi-target key recovery
CriticaldesignConfirmed sign-14-3 Fixed leaf-commitment tweaks enable multi-target key recovery
HighdesignProof gap sign-14-4 The quantum EUF-CMA proof misses every target through its TCCR error term
sign-15MORNING-ATLAS PDFLattice (Module-LWR, Fiat-Shamir)HighimplementationConfirmed sign-15-1 Returned-length error causes an out-of-bounds heap disclosure
HighimplementationConfirmed sign-15-2 Trivial hint-padding malleability violates SUF-CMA
CriticalimplementationConfirmed sign-15-3 The ATLAS-192 challenge space is below 192 bits
CriticalimplementationConfirmed sign-15-4 Repeated masking coefficients expose the signing key
HighimplementationConfirmed sign-15-5 Unchecked hint decoding causes out-of-bounds reads and writes
InfoevaluationWithdrawn sign-15-6 Withdrawn — official NICCS DRNG rotates by the word size
CriticaldesignConfirmed sign-15-7 Finite mask support leaks the specified ATLAS-128 signing key
CriticaldesignConfirmed sign-15-8 The specified ATLAS-512 challenge space is only 322.67 bits
CriticaldesignConfirmed sign-15-9 A 384-bit message representative caps ATLAS-256 and -512 forgery security at 192 bits
CriticaldesignConfirmed sign-15-10 A 256-bit mask key and key-generation seed cap ATLAS-512
HighimplementationConfirmed sign-15-11 Unused challenge-sign bits violate ATLAS strong unforgeability
CriticalimplementationConfirmed sign-15-12 A byte-wide position index shrinks the ATLAS-512 challenge image
CriticalimplementationConfirmed sign-15-13 Overlapping mask streams recover the ATLAS-512 signing key
sign-16Octarine PDFLattice-based signatureMediumdesignProof gap sign-16-1 The stated hash requirement is too weak for the EUF-CMA target
MediumdesignProof gap sign-16-2 Polynomial solutions of the relaxed Octarine-512 SIS estimates
sign-17OPS Digital Signature Algorithm PDFLattice-based signatureCriticaldesignConfirmed sign-17-1 The specified fixed-support challenge permits public-key forgeries in 2^39, 2^45, and 2^90
LowdesignConfirmed sign-17-2 The specified high-bit wrap rejects honest signatures
sign-18Origami PDFMultivariate (layered MQ)CriticaldesignConfirmed sign-18-1 A fixed 512-bit message prehash caps forgery security at 256 bits
MediumdesignConfirmed sign-18-2 Signatures expose the hidden-algebra constraint subspace
Mediumside-channelConfirmed sign-18-3 Variable-time hidden-zone linear solving
Lowside-channelConfirmed sign-18-4 Signing indexes field tables and signature state with private values
CriticaldesignConfirmed sign-18-5 Public variable permutation permits signature forgery
sign-19Phoenix PDFHash-based signatureLowimplementationConfirmed sign-19-1 Phoenix parameter sets define incompatible signature languages
LowimplementationConfirmed sign-19-2 SHAKE-384f AVX2 can exceed its declared signature buffer
MediumimplementationConfirmed sign-19-3 AVX2 SM3 chain and tree hashes omit the public seed
CriticalimplementationConfirmed sign-19-4 A 256-bit SM3 prehash caps message-retargeting security
MediumimplementationConfirmed sign-19-5 Every high-level SM3 signature exposes part of `SK.prf`
LowimplementationConfirmed sign-19-6 Reference high-level SM3 hashes copy past their digest buffers
sign-20Qing Luan PDFCode-based (restricted syndrome decoding, MPC-in-the-head)MediumdesignProof gap sign-20-1 Qingluan-128's own quantum accounting falls below the 80-bit target
InfodesignConfirmed sign-20-2 DRBG rollback is outside the security model, so the reported witness recovery is not an attack
CriticaldesignConfirmed sign-20-3 Nested SM3 multicollisions give sub-target message binding for QingLuan-384 and -512
Lowside-channelConfirmed sign-20-4 Signing re-expands the secret through a variable-work sampler
CriticaldesignConfirmed sign-20-5 Qing Luan's random-generation state caps the 384- and 512-bit sets at 256 bits
sign-21ReSolveD-α PDFCode-based (regular syndrome decoding, VOLE-in-the-head)CriticaldesignConfirmed sign-21-1 A shared TCCR tweak enables one-signature multi-target key recovery below the claimed levels
CriticaldesignConfirmed sign-21-2 A shared leaf-commitment tweak gives one-signature multi-target key recovery
InfodesignConfirmed sign-21-3 Same-key cross-profile access is outside EUF-CMA despite reproduced witness recovery
HighdesignProof gap sign-21-4 The quantum EUF-CMA proof misses every target through its TCCR error term
sign-22Rhyme PDFLattice-basedCriticalimplementationConfirmed sign-22-1 The implemented message representative caps forgery security at 256 bits
CriticalimplementationConfirmed sign-22-2 The implementation expands the complete key pair from a 256-bit root
MediumimplementationConfirmed sign-22-3 Rhyme-SM3 omits the specified doubled-width parity mask
CriticaldesignConfirmed sign-22-4 An undersized rejection envelope permits practical secret-tail recovery and forgery
LowimplementationConfirmed sign-22-5 A valid-bound response can overrun Rhyme-512's encoder table
CriticalimplementationConfirmed sign-22-6 Long messages share an all-zero representative in Rhyme-SM3
sign-23Shuttle PDFLattice (Module-LWE/Module-SIS)CriticaldesignConfirmed sign-23-1 Reversed transition leaks Shuttle's signing key
LowdesignConfirmed sign-23-2 Shuttle's ICCS build uses the external DRBG as an XOF
sign-24Sigurd PDFCode-based (regular syndrome decoding)CriticalimplementationConfirmed sign-24-1 Chunked Reed–Solomon encoding reveals the signing witness
CriticalimplementationConfirmed sign-24-2 Zero 16-bit challenge exposes the signing witness
sign-25SQIsign2D2 PDFIsogenyCriticalimplementationConfirmed sign-25-1 Verifier verdict is decided by stale stack contents
MediumdesignLead sign-25-2 Isogeny prime sizing relies on the former square-root attack cost
CriticaldesignConfirmed sign-25-3 Detached compact challenge enables one-query message-retargeting forgeries
sign-26SQIsign2D-push1/2 PDFIsogeny-based signatureMediumdesignLead sign-26-1 Prime sizing assumes a superseded square-root isogeny cost
CriticalimplementationConfirmed sign-26-2 Missing challenge grinding drops Levels 1 and 3 below their targets
MediumimplementationConfirmed sign-26-3 A failed final split can accept an altered signature in a reused verifier process
sign-27SQIsignTriangle PDFIsogeny/quaternion signatureLowimplementationConfirmed sign-27-1 An all-zero signature aborts the verifier process
MediumdesignLead sign-27-2 Triangle prime sizing relies on the former square-root attack cost
CriticaldesignConfirmed sign-27-3 A known signature transfers to a new message in about 2^(lambda/2) work
MediumdesignProof gap sign-27-4 Distinct challenges can share the identical response, invalidating special soundness
CriticaldesignConfirmed sign-27-5 Response rescaling gives a practical fresh-message forgery
sign-28SYDO PDFCode-based signature (syndrome decoding, MPC-in-the-head)CriticaldesignConfirmed sign-28-1 SYDO enforces two fewer grinding bits than its claimed soundness
MediumimplementationConfirmed sign-28-2 The reference verifier ignores required BAVC opening padding
MediumimplementationConfirmed sign-28-3 The implementations omit the Hash4 step required by the proof
LowimplementationConfirmed sign-28-4 Reference universal hashing reads beyond an eight-byte stack buffer
MediumimplementationConfirmed sign-28-5 An undocumented exported helper generates keys from a public constant
sign-29Tins PDFMultivariate (MPC-in-the-head)CriticaldesignConfirmed sign-29-1 One signature reveals the complete signing witness
LowimplementationConfirmed sign-29-2 Deterministic TINS expansion depends on the external DRBG
HighimplementationConfirmed sign-29-3 Unchecked signature length overflows the verifier's path buffer
MediumimplementationConfirmed sign-29-4 Tins128 compares its challenge with an uninitialized buffer
LowimplementationConfirmed sign-29-5 Tins512 verification overwrites the supplied signature
LowimplementationConfirmed sign-29-6 An odd challenge count writes past Tins512's stack array
CriticalimplementationConfirmed sign-29-7 Public-salt GGM expansion exposes the complete signing witness
sign-30TRINE PDFTrilinear-form group-action signatureCriticalimplementationConfirmed sign-30-1 The normal build deterministically exposes every signing key
CriticaldesignConfirmed sign-30-2 The specified 128-bit round seeds permit collision-accumulation forgeries
CriticalimplementationConfirmed sign-30-3 SHAKE256 capacity limits TRINE-512 transcript collision security
sign-31TSUOV PDFMultivariateCriticaldesignConfirmed sign-31-1 A 512-bit prehash caps forgery security at 256 bits
Mediumside-channelConfirmed sign-31-2 Secret-dependent echelon pivots during signing
HighimplementationConfirmed sign-31-3 Allocation failure reuses a stale message representative
LowimplementationConfirmed sign-31-4 Declared public-key and signature lengths are ignored
LowimplementationConfirmed sign-31-5 Impossible-length input wraps the message allocation
MediumdesignConfirmed sign-31-6 Noncanonical field encodings create signature and public-key aliases
HighdesignProof gap sign-31-7 The TSUOV-128 EUF-CMA proof loses its bound at 2^64 salt trials
sign-32UVW PDFCode-based (Wave-type, syndrome decoding over F3)CriticalimplementationConfirmed sign-32-1 Every signature is accepted
LowimplementationConfirmed sign-32-2 An all-zero signature crashes two verifier instances
CriticaldesignConfirmed sign-32-3 Pair-correlated signatures recover an equivalent UVW-128 signing key
LowimplementationConfirmed sign-32-4 UVW-Sign resets the external DRBG for deterministic matrix expansion
sign-33VDOO PDFMultivariate (UOV family)CriticalimplementationConfirmed sign-33-1 Publicly reproducible signing keys
CriticalimplementationConfirmed sign-33-2 A 256-bit implementation prehash limits forgery security to 128 bits
HighdesignProof gap sign-33-3 The VDOO-256 and -512 proof bound contains a 128-bit salt term
HighimplementationConfirmed sign-33-4 Signing reuses a publicly predictable randomness stream
Mediumside-channelConfirmed sign-33-5 Signing branches directly on private central-map coefficients
CriticalimplementationConfirmed sign-33-6 Restricted oil terms enable a public-key-only VDOO forgery
sign-34YuanYang.DSA PDFLattice-based (NTRU hash-and-sign)HighimplementationConfirmed sign-34-1 Wrong perturbation covariance leaks secret-basis information
MediumimplementationConfirmed sign-34-2 Non-injective public-key packing creates key aliases
HighimplementationConfirmed sign-34-3 Wrong wide-sampler constant leaks secret-basis information through signature means
LowimplementationConfirmed sign-34-4 Wrong Delta2 exponent causes excessive signing rejection
CriticalimplementationConfirmed sign-34-5 An unsalted 256-bit prehash permits signature transfer at the higher levels

KEMs

identifiercandidate / specfamilyseverityscopeupdatedvulnerability
kem-01Aigis-Enc+ PDFLattice (Module-LWE)CriticalimplementationConfirmed kem-01-1 Ineffective implicit rejection breaks IND-CCA security
LowimplementationConfirmed kem-01-2 Rejection reads a secret before the secret-key object
LowimplementationConfirmed kem-01-3 The external DRBG is used as a KDF
kem-02Amoeba PDFLattice-based (Ring-LWE)CriticalimplementationConfirmed kem-02-1 The FO check compares only every fourth ciphertext byte
Lowside-channelConfirmed kem-02-2 Secret-derived ECC decoding indexes a syndrome table
MediumdesignConfirmed kem-02-3 The decryption-failure bound omits detected two-error rejections
HighimplementationConfirmed kem-02-4 A one-bit ciphertext change writes outside the Hamming correction buffer
InfoevaluationWithdrawn kem-02-5 Withdrawn — unseeded caller repeats Amoeba keys
CriticalimplementationConfirmed kem-02-6 Pre-FO decoder failures give a full chosen-ciphertext key recovery
LowimplementationConfirmed kem-02-7 Four-way ECC loops overrun a 523-byte plaintext buffer
CriticalimplementationConfirmed kem-02-8 Amoeba's four-call SM3 expansion has only a 256-bit internal state
kem-03BAG-Loong PDFCode-based (rank metric)Mediumside-channelConfirmed kem-03-1 Secret-dependent pivoting in the Gabidulin decoder
HighdesignConfirmed kem-03-2 The rejection key does not bind the received ciphertext
CriticalimplementationConfirmed kem-03-3 Public support spaces reduce secret-key recovery to linear algebra
CriticaldesignConfirmed kem-03-4 Merged support reduces rank-decoding costs below three claimed levels
LowimplementationConfirmed kem-03-5 The decoder rejects supports permitted by the specification
kem-04BAG-Piglet PDFCode-based (rank metric)Mediumside-channelConfirmed kem-04-1 Secret-dependent pivoting in the Gabidulin decoder
HighdesignConfirmed kem-04-2 The rejection key does not bind the received ciphertext
kem-05BIKE-MLThre PDFCode-based (QC-MDPC)CriticalimplementationConfirmed kem-05-1 The default library deterministically generates a public secret key
CriticaldesignConfirmed kem-05-2 Same-key multi-instance decoding misses BIKE-MLThre-128 and -256 targets
kem-06BRA PDFCode-based (rank metric)LowimplementationConfirmed kem-06-1 Malformed inputs drive the BRA decoder out of bounds
LowimplementationConfirmed kem-06-2 Reference field multiplication touches one limb past its output
Highside-channelLead kem-06-3 The decoder address trace gives a candidate-specific key-recovery route
CriticalimplementationConfirmed kem-06-4 Ignored padding bits make ciphertexts malleable without changing the key
LowimplementationConfirmed kem-06-5 Secret-key expansion depends on the external DRBG
LowimplementationConfirmed kem-06-6 Short ciphertexts reach BRA's fixed-offset parser
kem-07BRQC PDFCode-based (rank metric)Highside-channelLead kem-07-1 The decoder address trace gives a candidate-specific key-recovery route
CriticalimplementationConfirmed kem-07-2 Ignored padding bits make ciphertexts malleable without changing the key
LowimplementationConfirmed kem-07-3 Secret-key expansion depends on the external DRBG
LowimplementationConfirmed kem-07-4 Short ciphertexts reach BRQC's fixed-offset parser
kem-08BW-KEM PDFLattice-based KEMLowside-channelConfirmed kem-08-1 C128 decapsulation branches on decrypted coefficients
kem-09CheetahKEM PDFLattice (Ring/Module-LWE)CriticalimplementationConfirmed kem-09-1 Partial rejection mask leaks the candidate shared secret
HighdesignLead kem-09-2 A degree-128 quotient defeats the full-dimension MLWE estimates
MediumdesignConfirmed kem-09-3 Cheetah's decryption-failure analysis omits public-key rounding
kem-10C-Multi-UR-AG PDFCode-based (rank metric)HighimplementationConfirmed kem-10-1 Malformed ciphertexts crash the reference decapsulator
Lowside-channelConfirmed kem-10-2 Secret-derived decoder pivots select memory addresses
CriticalimplementationConfirmed kem-10-3 Ignored padding bits make CMultiURAG-512 ciphertexts malleable without changing the key
LowimplementationConfirmed kem-10-4 Secret-key expansion depends on the external DRBG
LowimplementationConfirmed kem-10-5 Short ciphertexts reach the fixed-offset parser
LowimplementationConfirmed kem-10-6 Reference 79-bit field multiplication touches a fourth limb
kem-11COMPASS-KEM PDFLattice-basedCriticalimplementationConfirmed kem-11-1 COMPASS-KEM-384 and -512 use a 256-bit key-generation root
MediumdesignProof gap kem-11-2 The Biased-MLWR reduction does not instantiate the concrete small-secret sets
kem-12CTL PDFLattice-basedCriticaldesignConfirmed kem-12-1 The specified CTL-512 public-key space has at most 256 bits of support
CriticalimplementationConfirmed kem-12-2 CTL-512 returns only 384 shared-secret bits
kem-13DKEM (Ding Key Encapsulation) PDFLattice (Module-LWE)MediumdesignConfirmed kem-13-1 DKEM's rejection key does not bind the full ciphertext
MediumdesignConfirmed kem-13-2 Malicious public key defeats DKEM's contributory key derivation
MediumimplementationConfirmed kem-13-3 A 16-bit NTT butterfly silently breaks honest DKEM-512 sessions
LowimplementationConfirmed kem-13-4 DKEM ignores input lengths before fixed-size reads
kem-14DTRU PDFLattice-based (NTRU)HighimplementationConfirmed kem-14-1 Caller-declared ciphertext length overflows a decapsulation stack buffer
LowimplementationConfirmed kem-14-2 Decapsulation return value exposes the implicit-rejection branch
LowimplementationConfirmed kem-14-3 Rejection key omits the specified public-key binding
MediumdesignProof gap kem-14-4 Ring-paired DoubleE8 blocks invalidate DTRU's failure estimates
kem-15FLIT PDFLattice (NTRU-like KEM)LowimplementationConfirmed kem-15-1 FLIT512 reference and optimized implementations silently derive different keys
HighimplementationConfirmed kem-15-2 Optimized equality check accepts invalid ciphertexts and exposes a plaintext-checking oracle
CriticalimplementationConfirmed kem-15-3 The FIPS202 variants generate predictable keys because their RNG is never seeded
kem-16HARE PDFCode-based (quasi-cyclic)MediumdesignProof gap kem-16-1 Headline DFR values lack a reproducible HARE calculation
CriticaldesignConfirmed kem-16-2 Same-key multi-instance decoding misses three HARE targets
kem-17HEP-QC PDFCode-based (quasi-cyclic)CriticalimplementationConfirmed kem-17-1 Publicly reproducible secret keys
CriticaldesignConfirmed kem-17-2 HEP-QC-7 has at most 256 bits of key-generation support
CriticalimplementationConfirmed kem-17-3 First encapsulation in each process is publicly reproducible
HighdesignConfirmed kem-17-4 Public column multiplicities break the EPC-P assumption
Mediumside-channelConfirmed kem-17-5 Secret permutation and mixing matrix drive memory and control flow
kem-18LoongKEM PDFLattice (LWE)CriticalimplementationConfirmed kem-18-1 Partial rejection mask leaks the candidate shared secret
HighdesignLead kem-18-2 Reducible rings project LoongKEM into much smaller SLWE instances
CriticaldesignConfirmed kem-18-3 Public consistency equations recover Loong128 and Loong256 shared secrets
kem-19Lore PDFLattice (module-LWR)MediumdesignLead kem-19-1 Lore-512's reducible ring admits smaller quotient attacks
CriticaldesignConfirmed kem-19-2 Lore-384 and -512 emit 256-bit keys from 256-bit keygen seeds
kem-20MAMBA-Frost PDFLattice-based (learning with quantization)HighimplementationConfirmed kem-20-1 Fail-open key generation creates publicly decapsulatable keys
kem-21MAMBA-Viper PDFLattice-based (Module-LWQ) KEMCriticalimplementationConfirmed kem-21-1 Viper-384 and -512 restrict the secret to a 256-bit seed
kem-22Mithril PDFLattice (radical-ring LWR)MediumdesignConfirmed kem-22-1 Reversed decryption offset invalidates the failure estimate
kem-23Mito PDFCode-basedMediumimplementationConfirmed kem-23-1 Mito-E discards every erasure before Reed–Solomon decoding
LowimplementationConfirmed kem-23-2 Mito uses the external DRBG as an XOF
kem-24MORNING-Scabbard PDFLattice (Module-LWR)MediumimplementationConfirmed kem-24-1 Encryption omits the specified rounding constant
LowimplementationConfirmed kem-24-2 Unvalidated ciphertext length bypasses or overruns comparison
kem-25NEV PDFLattice-based (NTRU/RLWE hybrid)MediumdesignProof gap kem-25-1 Compressed NEV sets omit the implicit rejection required by their security argument
kem-26NSS-HQC PDFCode-based (HQC-type quasi-cyclic codes)MediumdesignConfirmed kem-26-1 Fixed-weight parity falsifies the DQCSD and JPCI assumptions
CriticaldesignProbable kem-26-2 NSS-HQC-256 failures enable reported equivalent-key recovery
CriticaldesignConfirmed kem-26-3 Ephemeral syndrome decoding misses the 256-, 384-, and 512-bit targets
CriticaldesignConfirmed kem-26-4 A 256-bit decryption sub-seed caps NSS-HQC-384 and -512
Criticalside-channelProbable kem-26-5 RS-decoder timing reportedly recovers an NSS-HQC-128 key
kem-27NTRE PDFLattice-based (NTRU) KEMCriticalimplementationConfirmed kem-27-1 NTRE-512's 256-bit secret seed caps offline key-recovery work
kem-28OAEP-NTRU PDFLattice (NTRU)CriticaldesignConfirmed kem-28-1 Noncanonical ciphertext encoding defeats IND-CCA security
kem-29Polar-KEM PDFLattice (polar-code-defined)CriticalimplementationConfirmed kem-29-1 The submission ships a complete public-key-only break
CriticaldesignConfirmed kem-29-2 The specified aligned basis directly exposes the secret isometry
HighdesignConfirmed kem-29-3 Decoding radii contradict the specified error and lattice geometry
CriticaldesignConfirmed kem-29-4 Norm-only validation gives one-query ciphertext aliases
kem-30PolarLAC PDFLattice-based (module-LWE with polar-code decoding)Criticalside-channelProbable kem-30-1 Re-encryption rejection sampling leaks the decrypted-message class
Mediumside-channelConfirmed kem-30-2 Secret-indexed LLR tables expose PolarLAC decoding through the cache
LowimplementationConfirmed kem-30-3 Reference and optimized PolarLAC fail cross-decapsulation
kem-31QIMEN-PIKE PDFIsogeny-basedLowimplementationConfirmed kem-31-1 Invalid ciphertexts trigger an assertion during decapsulation
CriticalimplementationConfirmed kem-31-2 Non-canonical field encodings make ciphertexts malleable without changing the key
LowimplementationConfirmed kem-31-3 Malformed public keys hang or abort encapsulation
MediumdesignConfirmed kem-31-4 A shared torsion mask leaks a square-coset constraint on the secret degree
kem-32QCTM PDFCode-based (quasi-cyclic twisted McEliece)LowimplementationConfirmed kem-32-1 Debug path retains the secret error vector
CriticaldesignConfirmed kem-32-2 Same-key multi-instance decoding misses QCTM-128 and -256 targets
CriticalimplementationConfirmed kem-32-3 The bundled RNG limits QCTM-512 key-generation randomness to 384 bits
MediumdesignConfirmed kem-32-4 Folding exposes an ordinary Goppa quotient of the public code
CriticaldesignLead kem-32-5 Reported structural key recovery for QCTM256 and QCTM512
kem-33QUBE PDFCode-basedMediumside-channelConfirmed kem-33-1 Decapsulation re-expands the private seed with a variable-length sampler
Mediumside-channelConfirmed kem-33-2 Decryption multiplication traverses secret support positions
CriticalimplementationConfirmed kem-33-3 The optimized API generates predictable keys and encapsulations
kem-34Rudraksh2 PDFLattice-based KEMMediumdesignProof gap kem-34-1 Rudraksh2-128 leaves only a 2^64-query Grover margin
LowimplementationConfirmed kem-34-2 Cortex-M4 uses an incompatible Minal decoder constant
LowimplementationConfirmed kem-34-3 KEM entry points ignore caller-declared buffer lengths
InfodesignConfirmed kem-34-4 Rudraksh2-II's modulus cannot support its specified NTT
kem-35Scloud+ PDFLattice-based (unstructured LWE with Barnes–Wall decoding)Highside-channelConfirmed kem-35-1 Re-encryption rejection sampling leaks the decrypted-message class
kem-36TRIKE PDFCode-basedHighdesignConfirmed kem-36-1 The specified TRIKE decoder rejects every tested honest ciphertext
LowdesignConfirmed kem-36-2 The specified weak-key test rejects every key
LowimplementationConfirmed kem-36-3 Decapsulation fails to free the private h0 buffer
MediumdesignProof gap kem-36-4 Boundary weak-key classes are omitted from the DFR bound
MediumdesignProof gap kem-36-5 The weak-key reduction assumes the secret parity checks are public
Mediumside-channelConfirmed kem-36-6 Decapsulation addresses depend on the secret support
InfodesignConfirmed kem-36-7 TRIKE shares the generic unsalted-FO multi-ciphertext loss, no TRIKE-specific weakness
LowimplementationConfirmed kem-36-8 TRIKE resets the external DRBG for deterministic re-encryption
kem-37TriQ-KEM PDFCode-basedMediumside-channelConfirmed kem-37-1 Decapsulation re-expands its private support with variable work
Mediumside-channelLead kem-37-2 FO re-encryption leaks the decrypted message through sampler timing
kem-38UVW Key Encapsulation Mechanism PDFCode-basedCriticalimplementationConfirmed kem-38-1 UVW-512 derives its encryption pair from only 256 bits
HighdesignConfirmed kem-38-2 UVW exposes a stable list-decoding failure oracle
Highside-channelProbable kem-38-3 Stateful timing reactions recover UVW-KEM-128 shared secrets
CriticalimplementationConfirmed kem-38-4 Unused c1 bits make ciphertexts malleable without changing the key
HighimplementationLead kem-38-5 The implementation's final decryption failures expose UVW's hidden pairs
LowimplementationConfirmed kem-38-6 UVW-256 and -512 leak retry matrices
LowimplementationConfirmed kem-38-7 UVW-KEM resets the external DRBG for key expansion and re-encryption
kem-39WeaverKEM PDFLattice (Module-LWR)MediumimplementationConfirmed kem-39-1 PRF substream reuse violates the IND-CPA proof's independence premise
MediumimplementationConfirmed kem-39-2 WeaverKEM-256 omits its high-layer BCH decoder
LowimplementationConfirmed kem-39-3 BCH decoders mis-correct some errors within their designed radius
LowimplementationConfirmed kem-39-4 Matrix and lifting samplers differ from the normative parsers
LowimplementationConfirmed kem-39-5 Message encoding uses the wrong half-modulus
kem-40YuanYang.KEM PDFLattice (NTRU)MediumimplementationConfirmed kem-40-1 Encryption discards the specified error polynomial
Lowside-channelConfirmed kem-40-2 Decapsulation addresses a private array with a secret-derived index
LowimplementationConfirmed kem-40-3 YuanYang resets the external DRBG for deterministic encryption
MediumimplementationConfirmed kem-40-4 Dead even-rounding corrections invalidate the submitted failure estimates
CriticalimplementationConfirmed kem-40-5 Truncated encryption seed permits a 2^440 challenge-key distinguisher at the 512-bit level
kem-41ZEN PDFLattice (NTRU)MediumdesignProof gap kem-41-1 The numerical DFR model averages over messages while the proof assumes worst-case correctness

Key exchange

identifiercandidate / specfamilyseverityscopeupdatedvulnerability
kex-01ADKEX (Authenticated Ding Key Exchange) PDFLattice (unilaterally authenticated KEM-based key exchange)MediumdesignConfirmed kex-01-1 The stated no-matching-session theorem is false for responder sessions
LowimplementationConfirmed kex-01-2 ADKEX-512 silently derives different keys in honest sessions
LowimplementationConfirmed kex-01-3 Incoming message lengths are ignored before fixed-size reads
kex-02AFS-KEX PDFLattice (Module-LWE AKE)CriticalimplementationConfirmed kex-02-1 The ephemeral key is generated once as long-term state
Lowside-channelConfirmed kex-02-2 Secret-derived decryption coefficients take a sign branch
MediumdesignConfirmed kex-02-3 Leaking one in-session encapsulated key permits initiator impersonation
MediumdesignConfirmed kex-02-4 A copied certified public key enables an unknown-key-share
MediumdesignConfirmed kex-02-5 An unauthenticated responder observes decapsulation failures
kex-03CreTAKE PDFLattice (composite AKE: KEM + signature)CriticalimplementationConfirmed kex-03-1 Bits-versus-bytes error reduces the ephemeral secret to 64 bits
CriticaldesignConfirmed kex-03-2 Omitting signatures from the KDF breaks transcript matching
HighdesignConfirmed kex-03-3 The generic double-key KEM fails its claimed first-key CCA game
CriticalimplementationConfirmed kex-03-4 Initiator length-unit error removes the NAXOS long-term-key binding
LowimplementationConfirmed kex-03-5 Ignored KEX message lengths cause pre-authentication out-of-bounds reads
LowimplementationConfirmed kex-03-6 POLARLAC reference and optimized vectors derive different shared secrets
CriticalimplementationConfirmed kex-03-7 K2K-PLAC512 encryption coins depend on only 128 message bits
kex-04DKEX (Ding Key Exchange) PDFLattice (mutually authenticated key exchange)LowimplementationConfirmed kex-04-1 DKEX-512 silently derives different keys in honest sessions
LowimplementationConfirmed kex-04-2 DKEX ignores input lengths before fixed-size reads
kex-05Loom PDFHybrid lattice KEM/signature AKELowdesignConfirmed kex-05-1 The specified decryption-failure rate causes honest-session aborts
HighdesignConfirmed kex-05-2 Ephemeral-key reuse recovers the complete Loom-KEM secret key
CriticaldesignConfirmed kex-05-3 Shuttle signing-key leakage enables permanent responder impersonation
LowimplementationConfirmed kex-05-4 Loom's ICCS build uses the external DRBG as an XOF
kex-06MAMBA-NIKE PDFLattice-based NIKECriticalimplementationConfirmed kex-06-1 MAMBA-NIKE-384 and -512 use only 256 secret-seed bits
HighdesignLead kex-06-2 Static-key reconciliation admits an active reaction-recovery path
MediumdesignProof gap kex-06-3 Reconciliation leakage makes the passive-security bound vacuous
kex-07NEV-AKE PDFLattice (NTRU/Ring-LWE AKE)MediumimplementationConfirmed kex-07-1 Both party identities are hard-wired to zero
kex-08NIIKE PDFIsogeny-based non-interactive key exchangeCriticaldesignConfirmed kex-08-1 The raw shared j-invariant is distinguishable from a uniform key
CriticalimplementationConfirmed kex-08-2 NIIKE-lv512 key generation cycles between two hard-coded secret keys
MediumdesignConfirmed kex-08-3 A crafted peer key forces the honest party's shared secret
LowimplementationConfirmed kex-08-4 Malformed peer keys terminate the honest party's process
kex-09TriQ-KEX PDFCode-based authenticated key exchangeMediumside-channelConfirmed kex-09-1 Decapsulation re-expands its secret key with a variable-length sampler
Mediumside-channelLead kex-09-2 FO re-encryption leaks the decrypted message through sampler timing

Hash functions

identifiercandidate / specfamilyseverityscopeupdatedvulnerability
hash-01AFS-TrEDM PDFSymmetric (sponge hash)Lowside-channelConfirmed hash-01-1 Partial-message bits control a machine branch
HighdesignConfirmed hash-01-2 Missing final-block separation gives a 2^64-query distinguisher
hash-02AXIS PDFSymmetric (stream-cipher-style hash)LowimplementationConfirmed hash-02-1 Allocation failure returns a successful all-zero digest
Lowside-channelConfirmed hash-02-2 Partial-bit AXIS update branches on secret state
CriticaldesignConfirmed hash-02-3 The invertible AXIS state caps AXIS-1024 second-preimage security at 768 bits
hash-03C Hash PDFSymmetric (compression-function-based)No finding——No published vulnerability finding
hash-04CHAMP PDFSymmetric (Cayley graph / matrix products)CriticaldesignConfirmed hash-04-1 Fixed-length outputs occupy only one determinant fiber
LowdesignLead hash-04-2 Projective positive-word collision lead for CHAMP-512
CriticaldesignConfirmed hash-04-3 Known-length preimages admit an exact square-root search
HighimplementationConfirmed hash-04-4 Unsupported digest lengths cause full-size writes
HighdesignConfirmed hash-04-5 Message bytes index a large precomputed matrix table
hash-05uHash PDFSymmetric (block-cipher-based hash)Lowside-channelConfirmed hash-05-1 Secret state indexes a 256-byte substitution table
CriticaldesignConfirmed hash-05-2 Narrow-pipe iteration limits uHash second-preimage security for long messages
CriticalimplementationConfirmed hash-05-3 Unused partial-byte bits cancel padding and give trivial collisions
hash-06Cuishen PDFSymmetric (block-cipher-based)No finding——No published vulnerability finding
hash-07Dragon Hash Family PDFSymmetric (permutation-based)No finding——No published vulnerability finding
hash-08Duet PDFSymmetric (sponge)No finding——No published vulnerability finding
hash-09Eijen PDFSymmetric (sponge, Sponge-F)CriticalimplementationConfirmed hash-09-1 Trivial collisions in all Eijen implementations
MediumdesignConfirmed hash-09-2 Cross-instance three-block relations
hash-10FEILIAN PDFSymmetric (matrix-based hash)LowimplementationConfirmed hash-10-1 Padding-allocation failure returns a successful all-zero digest
CriticalimplementationConfirmed hash-10-2 Three FEILIAN RTL cores have trivial zero-extension collisions
LowdesignConfirmed hash-10-3 The specification, examples and RTL define incompatible FEILIAN variants
LowimplementationConfirmed hash-10-4 C implementations hash storage bits outside partial-byte messages
LowimplementationConfirmed hash-10-5 C input-length conversion and padding arithmetic are unchecked
hash-11Garnet PDFSymmetric (AES-derived hash)Lowside-channelConfirmed hash-11-1 Secret state indexes AES T-tables
hash-12Iphe PDFSymmetric (Sponge-F hash)MediumdesignConfirmed hash-12-1 Cross-profile 512-bit output relation
hash-13JuziHash PDFSymmetric (sponge and capacity feed-forward)CriticaldesignConfirmed hash-13-1 Long messages reduce JuziHash-1024 second-preimage security below 1024 bits
hash-14Laurus PDFSymmetric (permutation-based)MediumdesignConfirmed hash-14-1 Laurus loses its function-domain separation at c=1024
hash-15Litchi PDFSymmetric (sponge)No finding——No published vulnerability finding
hash-16LLH PDFSymmetric (sponge)No finding——No published vulnerability finding
hash-17MasterCube PDFSymmetric (sponge, AndRX permutation)CriticalimplementationConfirmed hash-17-1 Trivial collisions at every rate boundary
MediumdesignConfirmed hash-17-2 The specified and implemented inverse rounds do not invert the forward round
hash-18MEGASCON PDFSymmetric (sponge)MediumdesignConfirmed hash-18-1 For short messages, the 384-bit digest is a prefix of the 512-bit digest
HighdesignConfirmed hash-18-2 The AVX-512 listing defines a noninjective S-box and practical collisions
hash-19MoFang Hash Function PDFSymmetric (block-cipher-based)CriticaldesignConfirmed hash-19-1 Round-key cancellation gives deterministic full-round collisions
hash-20MOZI PDFSymmetric (sponge)MediumdesignConfirmed hash-20-1 For short messages, the 384-bit digest is a prefix of the 512-bit digest
MediumdesignConfirmed hash-20-2 The specified final marker creates cross-rate relations absent from the implementation
hash-21Neulaser PDFSymmetric (PRNG-based iterated hash)CriticaldesignConfirmed hash-21-1 A local feedback collision merges complete Neulaser states
CriticaldesignConfirmed hash-21-2 Reduction modulo 2^32-5 creates reachable state mergers
Lowside-channelConfirmed hash-21-3 Secret state indexes a 256-byte S-box
CriticaldesignConfirmed hash-21-4 Long random messages admit second preimages in one scan
hash-22Pavelor PDFSymmetric (AES-derived sponge hash)Lowside-channelConfirmed hash-22-1 Secret state indexes the AES S-box and tail bits control a branch
hash-23QILIN PDFSymmetric (sponge)No finding——No published vulnerability finding
hash-24QuantaSylva Hash (QSH) PDFSymmetric (tree hash, ARX permutation)LowdesignConfirmed hash-24-1 Full-round core permutation has a one-query invariant-subspace distinguisher
CriticaldesignConfirmed hash-24-2 Truncated tree chaining values cap QSH second-preimage security
MediumdesignConfirmed hash-24-3 QSH admits full-mode free-start and low-cost semi-free-start collisions
hash-25TaiChi PDFSymmetric (sponge-like hash)LowimplementationConfirmed hash-25-1 Allocation failure reports success without writing a digest
hash-26The Hash Function CHIME PDFSymmetric (sponge and feed-forward sponge)CriticaldesignConfirmed hash-26-1 An invariant subspace reduces CHIME collision bounds to 64 and 224 bits
hash-27Vedak PDFSymmetric (sponge hash)Lowside-channelConfirmed hash-27-1 Secret state indexes an eight-bit substitution table
hash-28The XRH-1 Hash Function PDFSymmetric (sponge)No finding——No published vulnerability finding
hash-29The XRH-2 Hash Function PDFSymmetric (sponge)No finding——No published vulnerability finding
hash-30ZC-DM PDFSymmetric (feed-forward sponge)HighdesignLead hash-30-1 A conditional iterative trail gives a 2^384 full-round collision estimate
hash-31The ZC-DMC Hash Function PDFSymmetric (feed-forward sponge)MediumdesignConfirmed hash-31-1 Cross-domain distinguisher between ZC-1536-512 and ZC-1536-768
HighdesignLead hash-31-2 A conditional iterative trail gives a 2^384 full-round collision estimate
hash-32ZC-EDMC PDFSymmetric (sponge)LowdesignConfirmed hash-32-1 The specified and implemented ZC-EDMC mappings differ
HighdesignLead hash-32-2 A conditional iterative trail gives a 2^384 full-round collision estimate
hash-33Thunder Hash Family PDFSymmetric (permutation-based)No finding——No published vulnerability finding
hash-34WChain Hash Function PDFSymmetric (wide-pipe iterated hash)No finding——No published vulnerability finding
hash-35Wish PDFSymmetric (AES-derived sponge hash)Lowside-channelConfirmed hash-35-1 Secret-indexed S-box and variable-time field multiplication