AIMer
Symmetric · AIM · aimer-signature.org(opens in a new tab)
- Programmes
- KpqC selectedOn-ramp R1
- Latest version
- v3.0 ·
- Security flags
- None on current sets
Parameter sets
v3.0 · 31 Jul 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| AIMer-128f Note | 1 | 32 | 6,944 | 6,976 | 1.18 ms | 1.07 ms |
| AIMer-128s Note | 1 | 32 | 4,704 | 4,736 | 9.14 ms | 9.10 ms |
| AIMer-192f Note | 3 | 48 | 15,408 | 15,456 | 3.81 ms | 3.53 ms |
| AIMer-192s Note | 3 | 48 | 10,320 | 10,368 | 29.08 ms | 29.12 ms |
| AIMer-256f Note | 5 | 64 | 31,360 | 31,424 | 8.00 ms | 7.07 ms |
| AIMer-256s Note | 5 | 64 | 20,224 | 20,288 | 59.58 ms | 57.06 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (all parameter sets): v3.0 replaces AIM2 with AIM3. The earlier AIM2-based versions, v2.0 and v2.1 (the version KpqC selected), are broken by a public-key-only universal forgery (Liu et al.); the AIM cipher of v1.0 falls short of its claimed security (Liu, Mahzoun, Øygarden & Meier). We list v3.0 as the KpqC selection, expecting KpqC to adopt it.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| AIMer-128f | 1 | 32 to 32 | same | 5,888 to 6,944 | 18%larger | Flag cleared. Was Broken: Public-key-only universal forgery: in the BN++ relation for the inverse Mersenne S-boxes of AIM2, t^(2^e) + γt = pt·t, a zero S-box output t satisfies the equation for any pt, so anyone can build a witness that is not an AIM2 preimage and sign arbitrary messages under every honest key of every parameter set (Liu, Peng, Liu, Jia, Wang, Wang & Fan, confirmed by the AIMer team). The paper demonstrates it on the January 2026 AIM2 specification, which uses the same relation as v2.0 and v2.1. Separately, AIM2 itself is below its claimed security: key recovery in 2^103.7/2^147.5/2^213.2 for AIM2-I/III/V, practical with reused or related keys (Biryukov, García Fernández & Udovenko, EUROCRYPT 2026). Fixed in v3.0 (AIM3). |
| AIMer-128s | 1 | 32 to 32 | same | 4,160 to 4,704 | 13%larger | Flag cleared. Was Broken: Public-key-only universal forgery: in the BN++ relation for the inverse Mersenne S-boxes of AIM2, t^(2^e) + γt = pt·t, a zero S-box output t satisfies the equation for any pt, so anyone can build a witness that is not an AIM2 preimage and sign arbitrary messages under every honest key of every parameter set (Liu, Peng, Liu, Jia, Wang, Wang & Fan, confirmed by the AIMer team). The paper demonstrates it on the January 2026 AIM2 specification, which uses the same relation as v2.0 and v2.1. Separately, AIM2 itself is below its claimed security: key recovery in 2^103.7/2^147.5/2^213.2 for AIM2-I/III/V, practical with reused or related keys (Biryukov, García Fernández & Udovenko, EUROCRYPT 2026). Fixed in v3.0 (AIM3). |
| AIMer-192f | 3 | 48 to 48 | same | 13,056 to 15,408 | 18%larger | Flag cleared. Was Broken: Public-key-only universal forgery: in the BN++ relation for the inverse Mersenne S-boxes of AIM2, t^(2^e) + γt = pt·t, a zero S-box output t satisfies the equation for any pt, so anyone can build a witness that is not an AIM2 preimage and sign arbitrary messages under every honest key of every parameter set (Liu, Peng, Liu, Jia, Wang, Wang & Fan, confirmed by the AIMer team). The paper demonstrates it on the January 2026 AIM2 specification, which uses the same relation as v2.0 and v2.1. Separately, AIM2 itself is below its claimed security: key recovery in 2^103.7/2^147.5/2^213.2 for AIM2-I/III/V, practical with reused or related keys (Biryukov, García Fernández & Udovenko, EUROCRYPT 2026). Fixed in v3.0 (AIM3). |
| AIMer-192s | 3 | 48 to 48 | same | 9,120 to 10,320 | 13%larger | Flag cleared. Was Broken: Public-key-only universal forgery: in the BN++ relation for the inverse Mersenne S-boxes of AIM2, t^(2^e) + γt = pt·t, a zero S-box output t satisfies the equation for any pt, so anyone can build a witness that is not an AIM2 preimage and sign arbitrary messages under every honest key of every parameter set (Liu, Peng, Liu, Jia, Wang, Wang & Fan, confirmed by the AIMer team). The paper demonstrates it on the January 2026 AIM2 specification, which uses the same relation as v2.0 and v2.1. Separately, AIM2 itself is below its claimed security: key recovery in 2^103.7/2^147.5/2^213.2 for AIM2-I/III/V, practical with reused or related keys (Biryukov, García Fernández & Udovenko, EUROCRYPT 2026). Fixed in v3.0 (AIM3). |
| AIMer-256f | 5 | 64 to 64 | same | 25,120 to 31,360 | 25%larger | Flag cleared. Was Broken: Public-key-only universal forgery: in the BN++ relation for the inverse Mersenne S-boxes of AIM2, t^(2^e) + γt = pt·t, a zero S-box output t satisfies the equation for any pt, so anyone can build a witness that is not an AIM2 preimage and sign arbitrary messages under every honest key of every parameter set (Liu, Peng, Liu, Jia, Wang, Wang & Fan, confirmed by the AIMer team). The paper demonstrates it on the January 2026 AIM2 specification, which uses the same relation as v2.0 and v2.1. Separately, AIM2 itself is below its claimed security: key recovery in 2^103.7/2^147.5/2^213.2 for AIM2-I/III/V, practical with reused or related keys (Biryukov, García Fernández & Udovenko, EUROCRYPT 2026). Fixed in v3.0 (AIM3). |
| AIMer-256s | 5 | 64 to 64 | same | 17,056 to 20,224 | 19%larger | Flag cleared. Was Broken: Public-key-only universal forgery: in the BN++ relation for the inverse Mersenne S-boxes of AIM2, t^(2^e) + γt = pt·t, a zero S-box output t satisfies the equation for any pt, so anyone can build a witness that is not an AIM2 preimage and sign arbitrary messages under every honest key of every parameter set (Liu, Peng, Liu, Jia, Wang, Wang & Fan, confirmed by the AIMer team). The paper demonstrates it on the January 2026 AIM2 specification, which uses the same relation as v2.0 and v2.1. Separately, AIM2 itself is below its claimed security: key recovery in 2^103.7/2^147.5/2^213.2 for AIM2-I/III/V, practical with reused or related keys (Biryukov, García Fernández & Udovenko, EUROCRYPT 2026). Fixed in v3.0 (AIM3). |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site Attack
Public-key-only universal forgery on AIM2-based AIMer (Liu, Peng, Liu, Jia, Wang, Wang & Fan, ePrint 2026/2235): BN++ checks each inverse Mersenne S-box of AIM2 through the quadratic relation t^(2^e) + γt = pt·t, which holds for any pt when the S-box output t is zero. Setting all first-layer outputs to zero and pt = ct + b^(2^e*−1), computed from the public key alone, gives a witness that satisfies every checked equation without being an AIM2 preimage; the unmodified prover then signs any message, with probability one, for every honest key of every parameter set. Forgeries were accepted by the unmodified reference verifier for AIMer-128f/192f/256f (about 11.6 ms per AIMer-256f forgery). The paper attacks the January 2026 AIM2 specification; v2.0 and v2.1 use the same relation, so we mark them broken. The AIMer team confirmed the attack, and the AIM3 relation of v3.0 rules out the zero branch. The paper also forges signatures for some Lynxer variants. v1.0 (AIM) is not covered by the paper.
- added to site Update
AIMer v3.0 (specification, dated 31 July 2026) replaces AIM2 with AIM3, citing the Magic Pot attack: an IV-derived linear layer now precedes the first S-boxes (as proposed by Sun et al. for AIM2-patch) and the inverse Mersenne S-boxes become enhanced Mersenne S-boxes x^(2^e−1) + x^(2^n−2), whose quadratic relation only holds for non-zero inputs; key generation rejects keys with a zero S-box input. Parameter sets keep their names and public keys, but signatures grow by 13–25% (e.g. AIMer-128s 4,160→4,704 bytes, AIMer-256f 25,120→31,360 bytes). The specification no longer contains benchmarks, so no timings are shown for v3.0.
- New version
v3.0
- added to site Attack
Magic Pot (Biryukov, García Fernández & Udovenko, ePrint 2026/903, EUROCRYPT 2026): a new algebraic elimination framework recovers AIM2 keys from a single public key in 2^103.66, 2^147.46 and 2^213.19 encryptions for AIM2-I, -III and -V, below the claimed 128, 192 and 256 bits. If one secret key is reused under several IVs, or keys are related, key recovery becomes practical and was run: 11, 20 and 52 public keys in about 33, 30 and 37 hours. This affects AIMer v2.0 and v2.1; the AIMer team replaced AIM2 by AIM3 in v3.0 in response.
- added to site Attack
Sun, Chen, Liu, Wang & Niu (ePrint 2025/2272) give resultant-based algebraic attacks on AIM2: 2^188.76 primitive calls for AIM2-III with ω = 2 (2^195.05 with ω = 2.373), against 192 claimed bits, and 2^295.97 for AIM2-V via subfield reduction, about 2^100 below the designers’ Gröbner-basis estimate but above 256 bits. They propose AIM2-patch, which adds a linear layer after the key. The AIMer team’s January 2026 specification counts these attacks at more than an exhaustive search of AES at the same level. No flag change.
- added to site Milestone
KpqC announced its final algorithms: AIMer and HAETAE (signatures), NTRU+ and SMAUG-T (KEMs). AIMer was then at v2.1.
- added to site New version
v2.1
AIMer v2.1 (specification, announcement): implementation-only changes (PQClean compatibility, a memory-optimised C implementation, ARM SHAKE optimisation, and constant-time patches recommended by D. J. Bernstein). Sizes are unchanged from v2.0.
- added to site New version
v2.0
AIMer v2.0 (specification), the KpqC round-2 submission, replaces AIM with AIM2 (Kim, Ha, Son & Lee, ePrint 2023/1474) to counter the 2023 attacks on AIM: inverse Mersenne S-boxes in the first round and a distinct constant added before each S-box. It also halves the salt, adds message pre-hashing and cuts the twelve parameter sets to six (AIMer-128f/s, -192f/s, -256f/s). Signatures at the same level are similar in size to v1.0 (e.g. 4,160 bytes for AIMer-128s against 4,176 bytes for L1_PARAM3).
- added to site Attack
Zhang, Wang, Yu, Guo & Cui (ePrint 2023/1397, ASIACRYPT 2023) attack full AIM-III in 2^186.5 encryptions, below its 192-bit target, by exploiting the algebraic structure of its power-function S-boxes.
- added to site Attack
Liu, Mahzoun, Øygarden & Meier (ePrint 2023/1133, ToSC 2023(4)) find equivalent representations of full AIM that admit fast exhaustive search, recovering AIM-I/III/V keys in 2^136.2/2^200.7/2^265 bit operations, about 2^115/2^178/2^241 AIM evaluations. AIM therefore misses the NIST levels claimed by AIMer v1.0.
- New version
v1.0