SQIsign2D-push1/2
Isogenies · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Implementation findings (1 of 3 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| SQIsign2D-lvl2 | 128-bit | 96 | 218 | 314 | 312.83 ms | 63.21 ms |
| SQIsign2D-lvl3 Implementation findingsNote | 256-bit | 128 | 293 | 421 | 714.25 ms | 159.98 ms |
| SQIsign2D-lvl4 | 512-bit | 262 | 593 | 855 | 7.32 s | 1.73 s |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (SQIsign2D-lvl3): The submitted code skips the specified challenge grinding, so a forgery from one valid signature costs about 2^247, below the 256-bit target (Sun). Full findings report(opens in a new tab)
- Note (SQIsign2D-lvl3): Our build does not reproduce the submitted test vectors.
Only one version of SQIsign2D-push1/2 is recorded, so there is nothing to compare yet.
History
- added to site Update
SQIsign2D-push1/2 and SQIsign2D2 (SQISign2Dsquare): our build now patches the submitted verifiers so that they reject a signature whose final isogeny splitting step fails. The submitted code does not check that step and can then accept an altered signature (reported on ngcc.dev by LK-PQC-Hunter and Saarinen). Valid signatures are not affected.
- New version
Round 1