HAETAE
Lattices · MLWE/MSIS · kpqc.cryptolab.co.kr(opens in a new tab)
- Programmes
- KpqC selectedOn-ramp R1
- Latest version
- KS draft 260904 (code 1.2.0) ·
- Security flags
- None on current sets
Parameter sets
KS draft 260904 (code 1.2.0) · 4 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| HAETAE-2 Note | 2 | 992 | 1,474 | 2,466 | 1.45 ms | 41.1 µs |
| HAETAE-3 Note | 3 | 1,472 | 2,349 | 3,821 | 1.77 ms | 69.1 µs |
| HAETAE-5 Note | 5 | 2,080 | 2,948 | 5,028 | 2.21 ms | 82.9 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (all parameter sets): Implementation 1.2.0 (specification 260825, 25 August 2026) revises the hyperball sampler: the discrete Gaussian CDT grows from 64 entries at 16-bit precision to 166 entries at 83-bit precision (203 instead of 136 random bits per sample candidate), after Jipeng Zhang (National University of Singapore) raised a question about the precision of the discrete Gaussian sampler (acknowledged in specification 260904). Sizes are unchanged.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| HAETAE-2 | 2 | 992 to 992 | same | 1,474 to 1,474 | same | — |
| HAETAE-3 | 3 | 1,472 to 1,472 | same | 2,349 to 2,349 | same | — |
| HAETAE-5 | 5 | 2,080 to 2,080 | same | 2,948 to 2,948 | same | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site New version
KS draft 260904 (code 1.2.0)
HAETAE implementation 1.2.0 and the KS draft specifications 260825 (25 August 2026) and 260904 (4 September 2026), linked from the HAETAE page, revise the hyperball sampler: its discrete Gaussian CDT grows from 64 entries at 16-bit precision to 166 entries at 83-bit precision, so each sample candidate uses 203 instead of 136 random bits. The change follows a question by Jipeng Zhang (National University of Singapore) about the precision of the discrete Gaussian sampler, credited in specification 260904. Sizes are unchanged. We benchmark the 1.2.0 reference implementation (the release has no optimised code), fetched from the official download and pinned by its SHA-256; it reproduces the shipped KATs.
- added to site New version
KS draft 260204 (code 1.1.2)
HAETAE KS draft specification 260204 with implementation 1.1.2 (CryptoLabInc/HAETAE), prepared for Korean standardisation, renames the parameter sets HAETAE-120/180/260 to HAETAE-2/3/5 after their NIST levels. Sizes are those of v3.0.
- added to site Milestone
KpqC announced its final algorithms: AIMer and HAETAE (signatures), NTRU+ and SMAUG-T (KEMs). AIMer was then at v2.1.
- added to site New version
v3.0
HAETAE v3.0 (specification) corrects the secret-key sizes, which were missing 32 bytes (HAETAE-120 1,376→1,408 bytes), lowers B′ by 0.01 to satisfy Lemma 5, and replaces the 512-point FFT in key generation by a 256-point FFT (40–60% fewer key-generation cycles in AVX2). This is the version KpqC selected in January 2025.
- added to site New version
v2.1
HAETAE v2.1 (specification) adds an HVZK argument for compressed HAETAE, a precise security bound with refined MLWE estimates, and a list of reported attacks and fixes. Parameters and sizes are unchanged.
- added to site New version
v2.0
HAETAE v2.0 (specification), the KpqC round-2 submission, fixes the implementation errors behind the buffer-overflow (Saarinen) and rANS bit-flipping (HuFu team) forgeries of v1.0 and an uninitialised sum in the hyperball sampler, and changes the HAETAE-120/180 parameters to account for verification-key compression: signatures grow from 1,463/2,337/2,908 to 1,474/2,349/2,948 bytes. It adds AVX2 and Cortex-M4 implementations.
- New version
Round 1