BiT

BIT: Bimodal Triangular distribution based lattice signatures

Lattices · MLWE/MSIS · niccs.org.cn(opens in a new tab)

Programmes: NGCC R1
Latest version: Round 1 · 20 Sep 2026
Security flags: Broken (2 of 4 sets)

Third-party findings: full report on ngcc.dev(opens in a new tab).

Parameter sets

Round 1 · 20 Sep 2026

Parameter sets of BiT
Parameter set	Level	pk (B)	sig (B)	pk+sig (B)	Sign	Verify
BiT-128 Broken	128-bit	1,048	1,504	2,552	324.8 µs	95.0 µs
BiT-256	256-bit	2,144	3,456	5,600	582.7 µs	308.5 µs
BiT-512 Broken	512-bit	5,056	6,695	11,751	2.23 ms	903.8 µs
BiT-384	384-bit	2,435	5,251	7,686	no code(No implementation in the submission package)	no code(No implementation in the submission package)

Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.

Security flags

Broken (BiT-128): Equivalent signing keys can be recovered from a large but practical number of public signatures, enabling forgeries (Feussner).
Broken (BiT-512): The unsalted 512-bit message digest limits forgery resistance to about 2^256 work, below the 512-bit target (Saarinen).

Only one version of BiT is recorded, so there is nothing to compare yet.

History

20 Sep 2026 New version

Round 1

Full timeline →