Reports › kem-12 · Constant-time review

CTL (kem-12)

kem-12-1: The specified CTL-512 public-key space has at most 256 bits of support

CTL-512 claims 512-bit security, but its normative short private-key format stores one 32-byte key-generation seed. The specification requires f and g to be regenerated deterministically from this seed and recomputes the public key as h = f^-1 g mod q.

Consequently, at most 2^256 public keys can be generated. An attacker can enumerate the seeds, recompute h, and compare it with the target public key; a match recovers the target trapdoor data. This ceiling is independent of the nominal lattice dimensions and is present in both the specification and submitted code.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

python3 security/design_parameter_audit.py

The kem-12-1 check verifies the short-key algorithms on physical PDF pages 24 and 28–36 and the corresponding reference constants.

kem-12-2: CTL-512 returns only 384 shared-secret bits

Follow-up source: CTL submitters' 2026-09-23 response

The CTL-512 adapter returns a 48-byte shared secret and instantiates the ciphertext hash component c2 at 48 bytes. The specification assigns 64 bytes to CTL-512 c2.

The returned key therefore has at most 384 bits of delivered-key capacity and the ciphertext format contradicts the PDF. Output length alone is not an IND-CCA attack, so this second issue is classified as an implementation/specification conformance break rather than a complete KEM confidentiality attack.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

python3 security/design_parameter_audit.py

The kem-12-2 check verifies the CTL-512 output table and the corresponding reference constants.

The CTL submitters' response on 2026-09-23 acknowledges both findings and describes intended corrections; these reports remain scoped to the archived submission.