Phoenix
Symmetric · Hash-based · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Implementation findings (4 of 16 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Phoenix-SHAKE-192s | 128-bit | 48 | 13,332 | 13,380 | 230.52 ms | 4.00 ms |
| Phoenix-SHAKE-192f | 128-bit | 48 | 30,766 | 30,814 | 56.15 ms | 1.57 ms |
| Phoenix-SHAKE-256s | 256-bit | 64 | 24,618 | 24,682 | 1.02 s | 6.87 ms |
| Phoenix-SHAKE-256f | 256-bit | 64 | 44,906 | 44,970 | 22.91 ms | 3.12 ms |
| Phoenix-SHAKE-384s | 384-bit | 96 | 54,726 | 54,822 | 682.22 ms | 11.85 ms |
| Phoenix-SHAKE-384f | 384-bit | 96 | 88,442 | 88,538 | 149.68 ms | 7.48 ms |
| Phoenix-SHAKE-512s | 512-bit | 128 | 98,476 | 98,604 | 1.61 s | 8.01 ms |
| Phoenix-SHAKE-512f | 512-bit | 128 | 138,454 | 138,582 | 383.81 ms | 25.32 ms |
| Phoenix-SM3-192s Note | 128-bit | 48 | 13,332 | 13,380 | 3.02 s | 10.40 ms |
| Phoenix-SM3-192f Note | 128-bit | 48 | 30,766 | 30,814 | 152.71 ms | 4.10 ms |
| Phoenix-SM3-256s Note | 256-bit | 64 | 24,618 | 24,682 | 2.65 s | 18.02 ms |
| Phoenix-SM3-256f Note | 256-bit | 64 | 44,906 | 44,970 | 298.49 ms | 8.04 ms |
| Phoenix-SM3-384s Implementation findingsNote | 384-bit | 96 | 54,726 | 54,822 | 4.45 s | 28.50 ms |
| Phoenix-SM3-384f Implementation findingsNote | 384-bit | 96 | 88,442 | 88,538 | 947.17 ms | 17.97 ms |
| Phoenix-SM3-512s Implementation findingsNote | 512-bit | 128 | 98,476 | 98,604 | 6.50 s | 11.51 ms |
| Phoenix-SM3-512f Implementation findingsNote | 512-bit | 128 | 138,454 | 138,582 | 1.57 s | 35.79 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (Phoenix-SM3-192s, Phoenix-SM3-192f, Phoenix-SM3-256s, Phoenix-SM3-256f, Phoenix-SM3-384s, Phoenix-SM3-384f, Phoenix-SM3-512s, Phoenix-SM3-512f): Our build does not reproduce the submitted test vectors.
- Implementation findings (Phoenix-SM3-384s, Phoenix-SM3-384f, Phoenix-SM3-512s, Phoenix-SM3-512f): The submitted SM3 code compresses messages to 256 bits, so a second preimage after one signing query costs about 2^256, below this set's target (Saarinen). Full findings report(opens in a new tab)
Only one version of Phoenix is recorded, so there is nothing to compare yet.
History
- New version
Round 1