TRINE
Other · Trilinear Form Equiv. · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (2 of 6 sets) · Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| TRINE-128-Balanced BrokenImplementation findings | 128-bit | 16,004 | 3,156 | 19,160 | 7.84 s | 5.28 s |
| TRINE-128-ShortSig BrokenImplementation findings | 128-bit | 63,920 | 1,652 | 65,572 | 3.83 s | 1.55 s |
| TRINE-256-Balanced Implementation findings | 256-bit | 96,064 | 11,712 | 107,776 | 73.62 s | 44.08 s |
| TRINE-256-ShortSig Implementation findings | 256-bit | 384,064 | 5,968 | 390,032 | 30.18 s | 12.58 s |
| TRINE-512-Balanced Implementation findingsNote | 512-bit | 797,290 | 46,565 | 843,855 | timeout(Benchmark did not finish (operation over 600s)) | timeout(Benchmark did not finish (operation over 600s)) |
| TRINE-512-ShortSig Implementation findingsNote | 512-bit | 3,188,776 | 23,672 | 3,212,448 | 488.76 s | 196.96 s |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (TRINE-128-Balanced, TRINE-128-ShortSig): The specification's unsalted 128-bit round seeds allow a forgery after at most 2^64 signatures and about 2^95 work, below the target. The submitted code is salted (Feussner).
- Implementation findings (all parameter sets): The default SHA3 build regenerates the same signing keys every time (Feussner). In the 512-bit SHA3 build, SHAKE256 limits transcript collision resistance below the target (Saarinen). Full findings report(opens in a new tab)
- Note (TRINE-512-Balanced, TRINE-512-ShortSig): Our build could not check the submitted test vectors in time.
Only one version of TRINE is recorded, so there is nothing to compare yet.
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- New version
Round 1