SDitH
MPCitH · Synd. Dec. · sdith.org(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- v3.0.0 ·
- Security flags
- None on current sets
Parameter sets
v3.0.0 · 8 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| SDitH3-L1-gf2-short Recommended | 1 | 70 | 3,721 | 3,791 | 2.12 ms | 1.92 ms |
| SDitH3-L1-gf2-fast Recommended | 1 | 70 | 4,914 | 4,984 | 454.8 µs | 399.7 µs |
| SDitH3-L3-gf2-short Recommended | 3 | 98 | 8,484 | 8,582 | 8.96 ms | 8.86 ms |
| SDitH3-L3-gf2-fast Recommended | 3 | 98 | 10,852 | 10,950 | 2.08 ms | 1.95 ms |
| SDitH3-L5-gf2-short Recommended | 5 | 132 | 15,147 | 15,279 | 14.28 ms | 14.12 ms |
| SDitH3-L5-gf2-fast Recommended | 5 | 132 | 19,144 | 19,276 | 3.25 ms | 3.07 ms |
| SDitH3-L1-gf2-short-cipherpow | 1 | 70 | 3,721 | 3,791 | 1.97 ms | 1.92 ms |
| SDitH3-L1-gf2-fast-cipherpow | 1 | 70 | 4,643 | 4,713 | 447.0 µs | 382.3 µs |
| SDitH3-L3-gf2-short-cipherpow | 3 | 98 | 8,484 | 8,582 | 8.98 ms | 8.83 ms |
| SDitH3-L3-gf2-fast-cipherpow | 3 | 98 | 10,452 | 10,550 | 2.17 ms | 1.91 ms |
| SDitH3-L5-gf2-short-cipherpow | 5 | 132 | 15,147 | 15,279 | 14.25 ms | 14.10 ms |
| SDitH3-L5-gf2-fast-cipherpow | 5 | 132 | 19,144 | 19,276 | 3.24 ms | 3.07 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| SDitH3-L1-gf2-short | 1 | 70 to 70 | same | 3,705 to 3,721 | 0.4%larger | Flag cleared. Was Broken: Cross-signature signing-key recovery (Delgado, ePrint 2026/1808): the v2 VOLEitH PRG runs AES or Rijndael in counter mode from zero in every signature, so one key-search trial tests every exposed seed. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets. The round-3 v3.0 PRG salts its counter blocks. |
| SDitH3-L1-gf2-fast | 1 | 70 to 70 | same | 4,484 to 4,914 | 10%larger | Flag cleared. Was Broken: Cross-signature signing-key recovery (Delgado, ePrint 2026/1808): the v2 VOLEitH PRG runs AES or Rijndael in counter mode from zero in every signature, so one key-search trial tests every exposed seed. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets. The round-3 v3.0 PRG salts its counter blocks. |
| SDitH3-L3-gf2-short | 3 | 98 to 98 | same | 7,964 to 8,484 | 7%larger | Flag cleared. Was Broken: Cross-signature signing-key recovery (Delgado, ePrint 2026/1808): the v2 VOLEitH PRG runs AES or Rijndael in counter mode from zero in every signature, so one key-search trial tests every exposed seed. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets. The round-3 v3.0 PRG salts its counter blocks. |
| SDitH3-L3-gf2-fast | 3 | 98 to 98 | same | 9,916 to 10,852 | 9%larger | Flag cleared. Was Broken: Cross-signature signing-key recovery (Delgado, ePrint 2026/1808): the v2 VOLEitH PRG runs AES or Rijndael in counter mode from zero in every signature, so one key-search trial tests every exposed seed. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets. The round-3 v3.0 PRG salts its counter blocks. |
| SDitH3-L5-gf2-short | 5 | 132 to 132 | same | 14,121 to 15,147 | 7%larger | Flag cleared. Was Broken: Cross-signature signing-key recovery (Delgado, ePrint 2026/1808): the v2 VOLEitH PRG runs AES or Rijndael in counter mode from zero in every signature, so one key-search trial tests every exposed seed. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets. The round-3 v3.0 PRG salts its counter blocks. |
| SDitH3-L5-gf2-fast | 5 | 132 to 132 | same | 17,540 to 19,144 | 9%larger | Flag cleared. Was Broken: Cross-signature signing-key recovery (Delgado, ePrint 2026/1808): the v2 VOLEitH PRG runs AES or Rijndael in counter mode from zero in every signature, so one key-search trial tests every exposed seed. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets. The round-3 v3.0 PRG salts its counter blocks. |
| SDitH3-L1-gf2-short-cipherpow new in v3.0.0 | 1 | — to 70 | — | — to 3,721 | — | — |
| SDitH3-L1-gf2-fast-cipherpow new in v3.0.0 | 1 | — to 70 | — | — to 4,643 | — | — |
| SDitH3-L3-gf2-short-cipherpow new in v3.0.0 | 3 | — to 98 | — | — to 8,484 | — | — |
| SDitH3-L3-gf2-fast-cipherpow new in v3.0.0 | 3 | — to 98 | — | — to 10,452 | — | — |
| SDitH3-L5-gf2-short-cipherpow new in v3.0.0 | 5 | — to 132 | — | — to 15,147 | — | — |
| SDitH3-L5-gf2-fast-cipherpow new in v3.0.0 | 5 | — to 132 | — | — to 19,144 | — | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site Update
Added alternative and additional parameter sets for which official code exists; the main sets are marked, so the Recommended filter hides the new ones. SLH-DSA: the three SHAKE sets of the NIST SP 800-230 initial public draft (13 April 2026), SHAKE-128-24, SHAKE-192-24 and SHAKE-256-24, limited to 224 signatures per key, with 3,856, 7,752 and 14,944-byte signatures (Table 1). The draft is not final. We build them from the experimental SP 800-230 support in slhdsa-c PR #51 (not yet merged). The code of the FIPS 205 sets in our benchmark moved to that commit too; compared with before it adds a signature-length check in verification and larger stack buffers, and the algorithms are unchanged. Without a cached hypertree, key generation and each signature rebuild a 221–222-leaf tree and take minutes. SDitH: the six v3.0 instances with cipher-based grinding (specification Table 5, *-cipherpow), from the v3.0.0 code we already benchmark; the L1 and L3 fast instances have 4,643 and 10,452-byte signatures, the others match the main instances. SMAUG-T: TiMER, the additional level-1 parameter set of the v4.0 specification (672-byte public key, 608-byte ciphertext), from its AVX2 implementation in the SMAUG-T code we already benchmark. Timings for the new sets follow from our next benchmark run. Mirath-v, Mirath KeyGen2 and RYDE-v are not added because their code has not been published.
- added to site New version
v3.0.0
SDitH round-3 update (v3.0.0, github.com/sdith/sdith): the VOLEitH-based construction gets minor signature-size growth across all six gf2 parameter sets (Category I short/fast: 3705→3721 / 4484→4914 bytes; III: 7964→8484 / 9916→10852; V: 14121→15147 / 17540→19144), public-key sizes unchanged. Sizes verified against the tag's kat_r3 KAT vectors. A separate CIPHERPOW build variant is also introduced but not yet tracked here.
- added to site Attack
Delgado (ePrint 2026/1808) recovers SDitH v2 signing keys across signatures: the round-2 VOLEitH PRG runs AES or Rijndael in counter mode from zero, so every signature and leaf uses the same input and one encryption tests a candidate seed against every exposed value. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets; reduced-keyspace runs against the official code recover witnesses and produce accepted fresh signatures. The round-2 version is flagged broken. SDitH v3.0 builds its counter blocks from a tweak and the salt and is not affected.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- New version
v2.0
- New version
v1.0