UVW signature
Code-based · Synd. Dec. over F3 · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Latest version
- Round 1 ·
- Security flags
- Broken (2 of 3 sets) · Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
Round 1 · 20 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| UVW-128 BrokenImplementation findings | 128-bit | 5,897,612 | 1,244 | 5,898,856 | 2.83 s | 94.18 ms |
| UVW-256 BrokenImplementation findings | 256-bit | 23,040,012 | 2,444 | 23,042,456 | 32.87 s | 588.83 ms |
| UVW-512 Implementation findings | 512-bit | 95,160,012 | 4,956 | 95,164,968 | timeout(Benchmark did not finish (timeout)) | timeout(Benchmark did not finish (timeout)) |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (UVW-128): Correlated pairs in signatures reveal an equivalent signing key from a few hundred signatures, enabling forgery (Feussner).
- Implementation findings (all parameter sets): The submitted verifier accepts every signature, valid or not (Saarinen). Full findings report(opens in a new tab)
- Broken (UVW-256): Correlated pairs in signatures reveal an equivalent signing key from about 300 signatures, enabling forgery (Feussner, extended by Saarinen).
Only one version of UVW signature is recorded, so there is nothing to compare yet.
History
- Update
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
- New version
Round 1