TSUOV
Multivariate · UOV · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (1 of 3 sets) · Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| TSUOV_128 Implementation findings | 128-bit | 779 | 896 | 1,675 | 3.07 ms | 2.91 ms |
| TSUOV_256 Implementation findings | 256-bit | 2,170 | 2,412 | 4,582 | 18.43 ms | 17.98 ms |
| TSUOV_512 BrokenImplementation findings | 512-bit | 21,319 | 2,939 | 24,258 | 215.44 ms | 227.93 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (all parameter sets): On allocation failure the submitted verifier can reuse an earlier message digest and accept a signature for a different message (Xiong and Wang). Full findings report(opens in a new tab)
- Broken (TSUOV_512): The 512-bit message prehash limits forgery resistance to about 2^256 work, below the 512-bit target (Saarinen).
Only one version of TSUOV is recorded, so there is nothing to compare yet.
History
- New version
Round 1