QUBE
Code-based · QCSD · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Status
- NGCC round 1
- Security flags
- Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| QUBE-128 Implementation findings | 128-bit | 3,294 | 3,287 | 6,581 | 144.6 µs | 158.2 µs | 258.5 µs |
| QUBE-256 Implementation findings | 256-bit | 10,446 | 10,423 | 20,869 | 653.0 µs | 672.8 µs | 1.20 ms |
| QUBE-384 Implementation findings | 384-bit | 20,738 | 20,633 | 41,371 | 1.54 ms | 1.60 ms | 2.81 ms |
| QUBE-512 Implementation findings | 512-bit | 34,028 | 33,846 | 67,874 | 4.38 ms | 4.44 ms | 6.57 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (all parameter sets): The optimised implementation produces predictable keys and encapsulations (Xiong and Wang). Its FO check compares only part of each ciphertext, so one altered ciphertext decapsulates to the challenge key (Saarinen). Full findings report(opens in a new tab)
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.