Reports › kem-39
WeaverKEM (kem-39)
| Candidate | WeaverKEM |
|---|---|
| Family | Lattice (Module-LWR) |
| Scope | Reference implementation, all three parameter sets |
| Severity | High |
| Discovery | Non-trivial |
| Exploitation | Not yet demonstrated |
| Date | 2026-09-21 |
| Credit | Markku-Juhani O. Saarinen markku-juhani.saarinen@tuni.fi, with AI assistance |
| Archive | Weaver.zip (SHA-256: 9b0bad96e9bc836b0ff811492a70891066df5634ee47fda4d1518dccd4e09927) |
PRF substream reuse violates the IND-CPA proof's independence premise
The specification's encryption proof models randomized inverse-q lifting and the ephemeral secret r as independent PRF outputs obtained under distinct counters.
In the implementation, polyvec_invq receives its nonce by value and consumes counter 0 and later substreams internally. Its caller observes only one increment and begins sampling r at counter 1. The CBD input for r[0] is therefore a prefix of the same PRF(seed1, 1) stream already consumed by inverse-q lifting, with additional overlap depending on rejection and vector consumption.
The counter reuse is present in WeaverKEM-128, WeaverKEM-256, and WeaverKEM-512 and directly contradicts the independence premise used in Game 2 of the submitted proof. The correlation is confirmed, but it has not yet been converted into a concrete IND-CPA distinguisher or key-recovery algorithm. This is therefore a probable claim violation, not a claimed complete break.
Each logical sampler must receive a disjoint domain or counter range, and the nonce consumed inside polyvec_invq must be returned to or advanced by its caller.