Security › sign-14 · Constant-time review · Performance: x86_1 · arm_1

Lynxer (sign-14)

sign-14-1: A degenerate QuickSilver witness gives universal public-key-only forgeries

Original source: Feussner's PKC Forum post and pinned public analysis and reproducer Follow-up source: Lynxer team's confirmation and fix

Additional reference: Liu et al., ePrint 2026/2235

The specified QuickSilver relation fails to enforce two nonzero conditions. Set the purported Lynx key to the public constant c3 and the first S-box output v1 to zero. Every term in the first constraint then vanishes; the final constraint loses the public target because both its products contain either v1 or k+c3. The attacker publicly evaluates the second S-box to satisfy the sole remaining constraint. This gives a false witness for every public key and message without a signing query or Lynx preimage.

We reran the pinned attack against all six affected full reference parameter sets. Each secret-key buffer was erased before attack construction, direct Lynx evaluation confirmed that the forged key was not a victim preimage, the ordinary submitted verifier accepted the fresh-message signature, and a changed-message control rejected. The 160-bit relations differ and are not claimed to be vulnerable.

The Lynxer team confirms the flaw and reports that the Center for Cryptology Study at Tsinghua University found it independently. The archived Round 1 submission remains the target of this finding.

Liu et al. independently formalize the same null-branch witness mechanism, prove public-key-only forgery for the affected 256-, 384-, and 512-bit Lynxer relations, and report accepted fresh-message forgeries. Their separate Lynx-192 analysis concerns another upstream variant and does not extend this finding to the archived NGCC 160-bit sets.

On 2026-09-29 the Lynxer team also released a targeted modification note for its later revision, not the archived Round 1 package tested here.

Proposed fixes

The Lynxer team's response proposes replacing the original S-boxes with inversion as described in ePrint 2026/1099. Its later targeted-modification note describes an additional proposal for the revised construction. This section records the proposals without evaluating them.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

make -C sign-14 exploit-public-forgery

The wrapper checks out the pinned public reproducer, verifies the official source-archive hash, compiles against the archived reference code, and runs all six positive and changed-message controls. It requires Git, curl, unzip, and a C compiler.

sign-14-2: A shared TCCR tweak enables one-signature multi-target key recovery

Original source: Xiong and Wang's PKC Forum post and pinned verification package Follow-up source: Lynxer team's response

Within one BAVC tree, every expansion uses the same (s,iv) tweak; the bit entering TCCR selects an output block, not a node position (reference tccr.c:13–55, bavc.c:50–64; optimized prgs.hpp:494–540). The non-padding nodes published in decom_I, at most T_open, are therefore simultaneous targets for one enumeration of a hidden parent. A hit reconstructs the hidden leaf, u_0, the witness, and its first lambda bits—the OWF signing key. This contradicts the single-target argument in §8.2.2 (physical pp. 68–69); the construction and opening are specified in §§5.4.1 (p. 34) and 5.9.8 (p. 51).

For a signature containing T actual targets this costs about 2^lambda/(T+1). The T_open maxima give optimistic thresholds near 2^248.2, 2^375.6, and 2^503.2; a concrete transcript must use its actual target count. Each candidate parent changes the TCCR key x_R||iv, so a candidate test costs about one key schedule and one block-cipher call (§5.9.8, physical p. 51). The pinned package checks the tree relations and separately demonstrates a scaled key recovery and fresh-message forgery by targeting the public leaf commitments. The full-width tree-node enumeration is a theoretical below-target attack, not a practical forgery demonstration; its costs miss the 256-, 384-, and 512-bit claims, hence Critical. For the 160-bit profiles the analogous cost is about 2^153, above the NGCC 128-bit target but below Lynxer's stated 160-bit aim (§6.1, physical p. 53).

Proposed fixes

The Lynxer team proposes redefining the tweaks as node-index tweaks. Xiong and Wang's follow-up additionally proposes making the node index an actual TCCR input. These proposals are recorded without evaluating them.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

./sign-14/reproduce_tccr_multitarget.sh

sign-14-3: Fixed leaf-commitment tweaks enable multi-target key recovery

Original source: Xiong and Wang's PKC Forum post, leaf-index follow-up, and pinned verification package

The independent leaf commitment discards any node identity and calls prg_2_lambda(seed,iv,0) for every leaf (bavc.c:85–91,142–150; archived optimized vector_com.inc:1090–1115). One signature publishes a hidden-leaf commitment for each of tau VOLE instances (§5.4.7, physical p. 38; §8.2.3, physical p. 69). An enumeration can therefore test each candidate against all tau public commitments at once. A hit reconstructs the hidden leaf; the public correction values then give u_0 and the witness, whose first lambda bits are the signing key.

The resulting cost is about 2^lambda/tau, below the 256-, 384-, and 512-bit claims by about 4.5–6.2 bits. The leaf commitment is computed by a separate PRG call, not by the TCCR tree expansion, so this route does not depend on the tree's TCCR tweak. For the 160-bit profiles the cost is about 2^156, above the NGCC 128-bit target but below Lynxer's stated 160-bit aim (§6.1, physical p. 53). No full-width search was run.

Proposed fixes

Xiong and Wang propose including the leaf index in LeafHash. This records the proposal without evaluating it.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

./sign-14/reproduce_tccr_multitarget.sh

The scaled run searches against the public hidden-leaf commitment, recovers the key, and forges. The 1/tau full-size multi-target accounting is a counting certificate.

sign-14-4: The quantum EUF-CMA proof misses every target through its TCCR error term

Theorem 9.13 (physical p. 115) includes a quantum TCCR term O(D/2^(lambda-n)), independent of the attacker's work, where n is the block size: 128 for the 160/256-bit profiles and 256 for the 384/512-bit profiles (Table 7, physical p. 57). Lemma 9.11 (physical pp. 91–92) uses D=(2 ceil(log2 L)+5) tau, doubles the TCCR advantage, and multiplies by the number of commitments. Theorem 9.5 (physical pp. 92–93) sets that number to the signing-query count Q_sig.

Ignoring the hidden constant, this contributes about 2 Q_sig D/2^(lambda-n) to the quantum EUF-CMA bound. At Q_sig=1 its negative base-two logarithm is 22.1/21.7, 117.3/116.9, 116.6/116.3, and 244.2/243.8 bits for the s/f profiles. All miss their target, and the term grows with signatures. These are proof-error exponents, not attack costs. The bound is not shown tight, and this finding demonstrates no forgery or key recovery.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

python3 sign-14/reproduce_quantum_tccr_bound.py