UVW KEM
UVW Key Encapsulation Mechanism
Code-based · SD, (U+V,U+W) code distinguishing · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Status
- NGCC round 1
- Security flags
- Broken (all sets) · Implementation findings (2 of 3 sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| UVW-KEM-128 BrokenImplementation findings | 128-bit | 208,013 | 1,032 | 209,045 | 196.84 ms | 192.0 µs | 428.08 ms |
| UVW-KEM-256 Broken | 256-bit | 911,645 | 2,199 | 913,844 | 1.52 s | 588.3 µs | 2.97 s |
| UVW-KEM-512 BrokenImplementation findings | 512-bit | 4,001,850 | 4,820 | 4,006,670 | 11.98 s | 4.71 ms | 19.61 s |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (UVW-KEM-128): The cubic-jet method of Ghoshal, Ishai, Jain and Sun and of Weis, applied to shortened public codes, recovers an equivalent decapsulation key from the public key alone in under a minute (Liping Wang; key recovery by Saarinen).
- Implementation findings (UVW-KEM-128): Unused ciphertext bits in the submitted code let altered ciphertexts decapsulate to the same key (Saarinen). Full findings report(opens in a new tab)
- Broken (UVW-KEM-256): The same cubic-jet method distinguishes the public key from a random code, refuting the code-distinguishing assumption. Key recovery was not run at this size and is estimated at 2^57.75 bit operations (Liping Wang; distinguisher confirmed by Saarinen).
- Broken (UVW-KEM-512): This set has the structure that the cubic-jet method breaks at UVW-KEM-128 from the public key alone. No step was run at this size. Key recovery is estimated at 2^61.56 bit operations (Liping Wang).
- Implementation findings (UVW-KEM-512): Unused ciphertext bits let altered ciphertexts decapsulate to the same key (Saarinen). The encryption pair derives from only 256 bits, below the target (Saarinen). Full findings report(opens in a new tab)
History
- added to site Attack
UVW KEM: Liping Wang (PKC Forum) applies the cubic-jet multiplicity method of Ghoshal, Ishai, Jain and Sun (ePrint 2026/1630) and Weis (ePrint 2026/1984) to shortened public codes, following the shortening approach of Couvreur, Lequesne and Tillich for RLCE. This distinguishes UVW public keys from random codes and refutes the (U+V, U+W) code-distinguishing assumption of the security proof. The post estimates key recovery at 2^53.68, 2^57.75 and 2^61.56 bit operations for UVW-KEM-128, -256 and -512, far below the 128-, 256- and 512-bit targets. Saarinen (ngcc.dev) recovers an equivalent decapsulation key of UVW-KEM-128 from the public key alone in under a minute on 28 cores and confirms the distinguisher on a UVW-KEM-256 key. Key recovery has not been run for UVW-KEM-256 or -512. Yongge Wang (ePrint 2026/2710) predicts the same weakness at every parameter set. All three sets are now flagged broken.