Origami
Multivariate · Multivariate Quadratic · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Origami-128 Broken | 128-bit | 2,996 | 116 | 3,112 | 7.76 ms | 6.95 ms |
| Origami-256 Broken | 256-bit | 14,968 | 516 | 15,484 | 388.39 ms | 375.51 ms |
| Origami-384 Broken | 384-bit | 27,940 | 948 | 28,888 | 1.85 s | 1.78 s |
| Origami-512 Broken | 512-bit | 35,924 | 1,220 | 37,144 | 3.51 s | 3.28 s |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (all parameter sets): A public permutation of the variables lets anyone forge a signature on a chosen message without signing queries (Louiso and Ding; Pébereau). The larger sets' message digests are also too short for their targets (Saarinen).
Only one version of Origami is recorded, so there is nothing to compare yet.
History
- New version
Round 1