Lynxer
Symmetric · Lynx OWF · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (6 of 8 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Lynxer-160s | 128-bit | 40 | 4,607 | 4,647 | 19.81 ms | 16.94 ms |
| Lynxer-160f | 128-bit | 40 | 5,801 | 5,841 | 2.64 ms | 2.38 ms |
| Lynxer-256s Broken | 256-bit | 64 | 12,191 | 12,255 | 54.80 ms | 45.34 ms |
| Lynxer-256f Broken | 256-bit | 64 | 15,097 | 15,161 | 6.05 ms | 5.63 ms |
| Lynxer-384s Broken | 384-bit | 96 | 27,495 | 27,591 | 218.22 ms | 143.92 ms |
| Lynxer-384f Broken | 384-bit | 96 | 34,109 | 34,205 | 20.75 ms | 18.62 ms |
| Lynxer-512s Broken | 512-bit | 128 | 48,879 | 49,007 | 5.95 s | 5.30 s |
| Lynxer-512f Broken | 512-bit | 128 | 61,091 | 61,219 | 589.27 ms | 525.90 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (Lynxer-256s, Lynxer-256f, Lynxer-384s, Lynxer-384f, Lynxer-512s, Lynxer-512f): A degenerate witness lets anyone forge signatures from the public key at about the cost of honest signing (Feussner). One signature also allows key recovery below the target (Xiong and Wang).
Only one version of Lynxer is recorded, so there is nothing to compare yet.
History
- added to site Update
Lynxer, ReSolveD-ɑ and SYDO are now built from their submitted optimised x86 implementations (C++ with AVX2) instead of the reference code. The optimised builds reproduce the submitted test vectors and give the same key and signature sizes. Their earlier timings came from the reference code and are removed until our next benchmark run. Galas stays on its reference code, because its optimised code has no implementation of the NGCC signature interface.
- New version
Round 1