MORNING-ATLAS
Lattices · MLWR/MSIS · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (all sets) · Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| lwrdsa128 BrokenImplementation findingsNote | 128-bit | 1,328 | 2,081 | 3,409 | 1.25 ms | 685.5 µs |
| lwrdsa256 BrokenImplementation findingsNote | 256-bit | 2,848 | 4,656 | 7,504 | 1.52 ms | 854.2 µs |
| lwrdsa512 BrokenImplementation findingsNote | 512-bit | 6,688 | 10,081 | 16,769 | 4.21 ms | 2.49 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (all parameter sets): The specified 128-bit set leaks its key from millions of signatures (Feussner), the higher sets have challenge spaces, digests or seeds too small for their targets (Xiong and Wang), and sparse challenges break the claimed BUFF binding (Yan et al.).
- Implementation findings (all parameter sets): Repeated masking coefficients reveal the key (Lu and Liu; at 512 bits, Saarinen). Signatures are malleable (Saarinen; Xiong and Wang), hints and returned lengths overrun buffers (Song-Anxiao; Saarinen) and signed-message opening returns an unchecked message (Yan et al.). Full findings report(opens in a new tab)
- Note (all parameter sets): Our build does not reproduce the submitted test vectors.
Only one version of MORNING-ATLAS is recorded, so there is nothing to compare yet.
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- New version
Round 1