GreatWall
GreatWall Signature Algorithm
Symmetric · Pylon OWF · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (2 of 6 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| GreatWall192f | 128-bit | 50 | 8,012 | 8,062 | 2.82 ms | 3.64 ms |
| GreatWall192s | 128-bit | 50 | 6,804 | 6,854 | 11.22 ms | 26.07 ms |
| GreatWall256f | 256-bit | 66 | 14,260 | 14,326 | 5.17 ms | 6.12 ms |
| GreatWall256s | 256-bit | 66 | 12,236 | 12,302 | 17.82 ms | 36.00 ms |
| GreatWall512f Broken | 512-bit | 132 | 57,812 | 57,944 | 80.80 ms | 84.18 ms |
| GreatWall512s Broken | 512-bit | 132 | 50,012 | 50,144 | 324.39 ms | 522.23 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (GreatWall512f, GreatWall512s): Hashing with SHAKE256 limits forgery resistance to about 2^256 work after one signing query, below the 512-bit target (Feussner).
Only one version of GreatWall is recorded, so there is nothing to compare yet.
History
- New version
Round 1