Tins
MPCitH · NSBC · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (all sets) · Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| Tins128 BrokenImplementation findingsNote | 128-bit | 55 | 3,896 | 3,951 | DNF(Benchmark did not finish (valid signature rejected)) | DNF(Benchmark did not finish (valid signature rejected)) |
| Tins256 BrokenImplementation findings | 256-bit | 98 | 13,012 | 13,110 | DNF(Benchmark did not finish (tampered signature accepted)) | DNF(Benchmark did not finish (tampered signature accepted)) |
| Tins512 BrokenImplementation findings | 512-bit | 195 | 51,187 | 51,382 | DNF(Benchmark did not finish (tampered signature accepted)) | DNF(Benchmark did not finish (tampered signature accepted)) |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (all parameter sets): A single signature reveals the full signing witness through linear algebra, at every parameter set (Xie).
- Implementation findings (all parameter sets): The submitted verifier overflows a buffer on oversized signatures (LK-PQC-Hunter), and public-salt expansion exposes the witness (Saarinen). Full findings report(opens in a new tab)
- Note (Tins128): The submitted code failed its own test-vector run in our build.
Only one version of Tins is recorded, so there is nothing to compare yet.
History
- New version
Round 1