MAMBA-Viper
Lattices · MLWQ · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Status
- NGCC round 1
- Security flags
- Broken (2 of 4 sets) · Implementation findings (2 of 4 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| MAMBA-Viper-128 | 128-bit | 608 | 736 | 1,344 | 37.9 µs | 59.5 µs | 68.2 µs |
| MAMBA-Viper-256 | 256-bit | 1,312 | 1,472 | 2,784 | 120.3 µs | 155.5 µs | 164.4 µs |
| MAMBA-Viper-384 BrokenImplementation findings | 384-bit | 2,496 | 2,656 | 5,152 | 343.8 µs | 397.7 µs | 404.9 µs |
| MAMBA-Viper-512 BrokenImplementation findings | 512-bit | 3,200 | 3,456 | 6,656 | 553.5 µs | 620.2 µs | 631.3 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (MAMBA-Viper-384, MAMBA-Viper-512): The specification derives every session secret from a 256-bit seed, so a passive search recovers shared keys below this set's target (Saarinen).
- Implementation findings (MAMBA-Viper-384, MAMBA-Viper-512): The submitted code derives the secret from a 256-bit seed, so key search falls below this set's target (Saarinen). Full findings report(opens in a new tab)
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.