Reports › kem-21 · Constant-time review

MAMBA-Viper (kem-21)

kem-21-1: Viper-384 and -512 restrict the secret to a 256-bit seed

The specification's Viper.PKE.KeyGen (Algorithm 3) samples the long-term secret vector coefficient-wise from the full centered-binomial distribution, and Table 3 claims 384- and 512-bit classical security for these profiles. Both submitted implementations instead draw a single 32-byte sseed and deterministically expand it with SHAKE256 into the entire secret vector s. The independent 32-byte rho only determines public A and its dither; it is copied into the public key.

For a target public key, an attacker can enumerate all 2^256 candidate sseed values, regenerate s, recompute the public quantized vector using the observed rho, and compare it with the public key. A matching seed gives the long-term PKE secret required to decapsulate valid ciphertexts. This caps the implemented 384- and 512-bit profiles at 256-bit offline key-search work regardless of the full-distribution lattice estimate. The attack violates both advertised security claims, hence the Critical severity. It is not an attack on the specification's ideal secret sampler, and a full 2^256 search was not run.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

python3 kem-21/reproduce_seed_ceiling.py

The static witness checks the 32-byte draw, the deterministic secret expansion, and the public-key construction in both reference source trees. It does not claim a practical full-size key recovery.