DARTS
Lattices · MLWE/MSIS · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (1 of 3 sets) · Implementation findings (1 of 3 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| DARTS128 Broken | 128-bit | 1,120 | 1,449 | 2,569 | 3.00 ms | 79.9 µs |
| DARTS256 | 256-bit | 2,208 | 2,489 | 4,697 | 5.07 ms | 204.3 µs |
| DARTS512 Implementation findings | 512-bit | 4,672 | 5,851 | 10,523 | 5.19 ms | 404.0 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (DARTS128): A restart in the signing procedure leaks an equivalent signing key after tens of millions of public signatures, enabling forgery (Shi).
- Implementation findings (DARTS512): The submitted code compresses messages so that forgery costs about 2^256 (Saarinen), and its AVX2 build draws the signing secret from a 256-bit seed, well below the 512-bit target (LK-PQC-Hunter, extended by Saarinen). Full findings report(opens in a new tab)
Only one version of DARTS is recorded, so there is nothing to compare yet.
History
- New version
Round 1