COMPASS-SIG
Lattices · MLWE/Shell-MISIS · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Implementation findings (3 of 4 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| COMPASS-SIG-128 | 128-bit | 1,664 | 2,080 | 3,744 | 663.5 µs | 382.0 µs |
| COMPASS-SIG-256 Implementation findings | 256-bit | 3,616 | 4,080 | 7,696 | 1.91 ms | 1.42 ms |
| COMPASS-SIG-384 Implementation findings | 384-bit | 5,792 | 7,344 | 13,136 | 1.56 ms | 968.4 µs |
| COMPASS-SIG-512 Implementation findings | 512-bit | 7,648 | 9,024 | 16,672 | 2.29 ms | 1.53 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (COMPASS-SIG-256): The submitted SHAKE wrapper compresses long messages to 256 bits, so a collision in about 2^128 work moves a signature to another message, below this set's target (Saarinen). Full findings report(opens in a new tab)
- Implementation findings (COMPASS-SIG-384, COMPASS-SIG-512): The key pair expands from a 256-bit seed (Saarinen), the message representative has 256 bits (Saarinen) and long messages are compressed to 256 bits (Saarinen). Each puts this set below its target, as does the shrunken challenge space (Sun). Full findings report(opens in a new tab)
Only one version of COMPASS-SIG is recorded, so there is nothing to compare yet.
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- New version
Round 1