Rhyme
Lattices · GA-MLWE/MSIS · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Implementation findings (6 of 8 sets) · Warning (1 of 8 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Rhyme-SM3-128 Implementation findings | 128-bit | 800 | 5,156 | 5,956 | 933.2 µs | 119.6 µs |
| Rhyme-SM3-256 Implementation findings | 256-bit | 1,824 | 10,308 | 12,132 | 1.84 ms | 192.9 µs |
| Rhyme-SM3-384 Implementation findings | 384-bit | 2,720 | 14,436 | 17,156 | 3.96 ms | 374.5 µs |
| Rhyme-SM3-512 Implementation findings | 512-bit | 3,872 | 20,612 | 24,484 | 2.15 ms | 406.1 µs |
| Rhyme-SHAKE-128 Warning | 128-bit | 800 | 5,156 | 5,956 | 556.4 µs | 49.2 µs |
| Rhyme-SHAKE-256 | 256-bit | 1,824 | 10,308 | 12,132 | 854.2 µs | 188.9 µs |
| Rhyme-SHAKE-384 Implementation findings | 384-bit | 2,720 | 14,436 | 17,156 | 1.60 ms | 240.1 µs |
| Rhyme-SHAKE-512 Implementation findings | 512-bit | 3,872 | 20,612 | 24,484 | 1.70 ms | 323.8 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (Rhyme-SM3-128, Rhyme-SM3-256): In the SM3 build, messages longer than the hash input limit all map to the same value, so one such signature verifies for any other long message (Saarinen). Full findings report(opens in a new tab)
- Implementation findings (Rhyme-SM3-384, Rhyme-SM3-512): In the SM3 build long messages all map to the same value, and the key seed and message digest limit attacks to about 2^256 work, below this set's target (Saarinen). Full findings report(opens in a new tab)
- Warning (Rhyme-SHAKE-128): A signer that follows the specification's rejection bound leaks the secret tail after 40,000 signatures, enabling forgery. The submitted signer is not affected (Feussner).
- Implementation findings (Rhyme-SHAKE-384, Rhyme-SHAKE-512): The submitted code expands the key pair from a 256-bit seed and its message digest limits forgery to about 2^256 work, below this set's target (Saarinen). Full findings report(opens in a new tab)
Only one version of Rhyme is recorded, so there is nothing to compare yet.
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- New version
Round 1