BAG-Loong
Code-based · Rank Synd. Dec. · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Status
- NGCC round 1
- Security flags
- Broken (3 of 4 sets) · Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| BAG-Loong-128 Implementation findings | 128-bit | 2,500 | 3,071 | 5,571 | 13.64 ms | 14.13 ms | 24.88 ms |
| BAG-Loong-256 BrokenImplementation findings | 256-bit | 6,597 | 8,400 | 14,997 | 36.09 ms | 31.23 ms | 60.97 ms |
| BAG-Loong-384 BrokenImplementation findings | 384-bit | 12,152 | 15,112 | 27,264 | 82.60 ms | 63.37 ms | 125.09 ms |
| BAG-Loong-512 BrokenImplementation findings | 512-bit | 19,043 | 21,660 | 40,703 | 139.37 ms | 92.72 ms | 181.28 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (all parameter sets): The submitted reference code publishes the support spaces, reducing secret-key recovery to linear algebra that runs in under a second (Zihan Liu). Full findings report(opens in a new tab)
- Broken (BAG-Loong-256, BAG-Loong-384, BAG-Loong-512): Merging error supports lowers the cost of rank-decoding key recovery below this set's claimed level (Xiong and Wang).
History
No events recorded for this scheme yet.