FlexTree
Symmetric · Hash-based · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Flextree-160s Broken | 128-bit | 40 | 9,580 | 9,620 | 2.31 s | 6.03 ms |
| Flextree-160f Broken | 128-bit | 40 | 18,672 | 18,712 | 153.26 ms | 4.37 ms |
| Flextree-256s Broken | 256-bit | 64 | 25,420 | 25,484 | 2.56 s | 11.04 ms |
| Flextree-256f Broken | 256-bit | 64 | 46,856 | 46,920 | 269.36 ms | 7.14 ms |
| Flextree-384s Broken | 384-bit | 96 | 60,180 | 60,276 | 12.36 s | 15.29 ms |
| Flextree-384f Broken | 384-bit | 96 | 73,396 | 73,492 | 3.46 s | 35.49 ms |
| Flextree-512s Broken | 512-bit | 128 | 94,948 | 95,076 | 23.82 s | 33.25 ms |
| Flextree-512f Broken | 512-bit | 128 | 117,296 | 117,424 | 6.98 s | 44.68 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (Flextree-160s, Flextree-160f): Verifiers that follow the specification omit its encoding checks and accept forgeries after about 2^40 work. The submitted verifier is not affected (Kudinov).
- Broken (Flextree-256s, Flextree-256f, Flextree-384s, Flextree-384f, Flextree-512s, Flextree-512f): Grinding a signing counter cuts forgery cost by 20 to 30 bits, below this set's target (Kudinov). Verifiers that follow the specification also accept forgeries after about 2^40 work (Kudinov).
Only one version of FlexTree is recorded, so there is nothing to compare yet.
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- New version
Round 1