Facto-DSA
Other · Cubic factorisation · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (2 of 3 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Facto-DSA-128 Broken | 128-bit | 40,040 | 40 | 40,080 | 283.1 µs | 245.3 µs |
| Facto-DSA-256 | 256-bit | 456,960 | 68 | 457,028 | 1.03 ms | 2.73 ms |
| Facto-DSA-512 BrokenNote | 512-bit | 5,674,240 | 128 | 5,674,368 | 50.87 ms | 38.18 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (Facto-DSA-128): An equivalent signing trapdoor can be computed from the public key in seconds (MingLLuo). Unsalted digests also let signatures be transferred to new messages below the target (Saarinen).
- Broken (Facto-DSA-512): Unsalted message digests let a collision transfer a signature to a new message with less work than the 512-bit target (Saarinen).
- Note (Facto-DSA-512): No submitted test vectors for this instance.
Only one version of Facto-DSA is recorded, so there is nothing to compare yet.
History
- New version
Round 1