Timeline
Scheme data updates, attacks and programme milestones tracked on this site.
Showing all 66 events
-
ML-DSA, MAYO and ML-KEM: we moved our builds to the latest upstream code. ML-DSA uses the pq-crystals reference at d35ba3f, with two AVX2 conformance fixes by Gregor Seiler: the stricter infinity-norm check FIPS 204 requires (issue 113) and the rounding of
use_hintwhen the low part is zero (bba9534, reported by Eric Biggers). MAYO uses MAYO-C at 412cb8a, which makes the generic echelon-form routine constant-time; our GFNI/AVX-512 build uses the AVX2 echelon-form code, which this commit does not change. ML-KEM uses mlkem-native v2.0.0. Sizes are unchanged and upstream's known-answer tests pass for every set. We re-benchmarked all three on AWS c8i.4xlarge; the timings do not change beyond run-to-run variation. -
NGCC round 1: we checked every confirmed critical and high-severity finding on ngcc.dev against our data, and the PKC Forum, the ngcc-harness issues, the public analysis repositories and ePrint for findings ngcc.dev does not list. New broken flags: OPS-DSA, whose specified challenge sampler allows forgery from the public key in 2^39 to 2^90 trials (Xiong and Wang); the compact SQIsign2D2 sets, where one signature yields forgeries on fresh messages (Feussner); BAG-Piglet, whose specified rejection key gives key recovery from decapsulation queries (Saarinen); MAMBA-Viper-384 and -512, whose specification derives every session secret from a 256-bit seed (Saarinen); FlexTree-160, where verifiers that follow the specification accept forgeries after about 2^40 work (Kudinov); TRINE-128, whose specified unsalted round seeds allow forgery in about 2^95 work (Feussner); and UVW-256 signatures, which leak an equivalent signing key as at UVW-128 (Feussner, extended by Saarinen). New warnings: HEP-QC, whose public key is distinguishable from random (Xie), and Rhyme-SHAKE-128, where a signer that follows the specified rejection bound leaks its secret (Feussner). New implementation notes cover rejection keys over the re-encryption (CheetahKEM, LoongKEM), partial FO checks (QUBE), buffer overflows (Amoeba, MORNING-ATLAS), 32-bit message lengths (Aigis-Sig+, CS), message compression and short prehashes (COMPASS-SIG, VDOO, Amoeba), wrapper boundaries and signed-message opening (VDOO, MORNING-ATLAS), malleable encodings (SQIsignTriangle) and fail-open key generation (ZEN). Each flag credits and links its finding.
Schemes: OPS-DSA, SQIsign2D2, BAG-Piglet, MAMBA-Viper, FlexTree, TRINE, UVW signature, HEP-QC, Rhyme, CheetahKEM, LoongKEM, QUBE, Amoeba, MORNING-ATLAS, Aigis-Sig+, CS, COMPASS-SIG, VDOO, SQIsignTriangle, ZEN
-
UVW KEM: Liping Wang (PKC Forum) applies the cubic-jet multiplicity method of Ghoshal, Ishai, Jain and Sun (ePrint 2026/1630) and Weis (ePrint 2026/1984) to shortened public codes, following the shortening approach of Couvreur, Lequesne and Tillich for RLCE. This distinguishes UVW public keys from random codes and refutes the (U+V, U+W) code-distinguishing assumption of the security proof. The post estimates key recovery at 2^53.68, 2^57.75 and 2^61.56 bit operations for UVW-KEM-128, -256 and -512, far below the 128-, 256- and 512-bit targets. Saarinen (ngcc.dev) recovers an equivalent decapsulation key of UVW-KEM-128 from the public key alone in under a minute on 28 cores and confirms the distinguisher on a UVW-KEM-256 key. Key recovery has not been run for UVW-KEM-256 or -512. Yongge Wang (ePrint 2026/2710) predicts the same weakness at every parameter set. All three sets are now flagged broken.
Schemes: UVW KEM
- (added to site ) Update Programmes: Site updates
Re-benchmarked every scheme on AWS c8i.4xlarge with one compiler flag set for all of them (-O3 -march=native -fno-semantic-interposition -DNDEBUG, with Ubuntu's default stack-protector, FORTIFY_SOURCE, stack-clash and CET hardening turned off, since they are not part of any algorithm). For the nine schemes still in the NIST on-ramp, the round-1 and round-2 versions are now timed from their own round's code, so scheme pages compare versions on one machine.
-
QR-UOV rounds 1 and 2: key and signature sizes now follow the submitted code where it differs from the specification. In both rounds the public keys of I-(127, 156, 54, 3) and III-(127, 228, 78, 3) and the public key and signature of III-(31, 246, 87, 3) are one byte larger (round 2: 24,256, 71,892, and 70,984 and 233 bytes). The round-1 code builds III-(7, 1100, 140, 10) with v = 1150, so its signature is 508 bytes instead of the specification's 489. Each changed set notes the specification's value.
Schemes: QR-UOV
-
SQIsign2D-push1/2 and SQIsign2D2 (SQISign2Dsquare): our build now patches the submitted verifiers so that they reject a signature whose final isogeny splitting step fails. The submitted code does not check that step and can then accept an altered signature (reported on ngcc.dev by LK-PQC-Hunter and Saarinen). Valid signatures are not affected.
Schemes: SQIsign2D-push1/2, SQIsign2D2
-
LESS: the signature sizes of LESS-252-192, LESS-400-220 and LESS-548-345 are now the maximum sizes of the submitted code (2,609, 6,353 and 10,712 bytes) instead of the specification's Table 4 (2,625, 6,329 and 10,680 bytes).
Schemes: LESS
- (added to site ) Update Programmes: Site updates
Re-benchmarked every signature and KEM on AWS c8i.4xlarge (Intel Xeon 6975P-C, core cycles via rdpmc), replacing the c7i.4xlarge timings of 2026-10-13. This also times for the first time the C++ optimised builds of Lynxer, ReSolveD-α and SYDO, the SNOVA, SDitH and SMAUG-T alternative sets, and the SP 800-230 SLH-DSA-SHAKE-*-24 sets, which are exempt from our 10-minute limit: one signature takes 6.6–11.3 minutes. TRINE-512-Balanced still exceeds the limit.
-
Lynxer, ReSolveD-ɑ and SYDO are now built from their submitted optimised x86 implementations (C++ with AVX2) instead of the reference code. The optimised builds reproduce the submitted test vectors and give the same key and signature sizes. Their earlier timings came from the reference code and are removed until our next benchmark run. Galas stays on its reference code, because its optimised code has no implementation of the NGCC signature interface.
Schemes: Lynxer, ReSolveD-ɑ, SYDO
-
Added alternative and additional parameter sets for which official code exists; the main sets are marked, so the Recommended filter hides the new ones. SLH-DSA: the three SHAKE sets of the NIST SP 800-230 initial public draft (13 April 2026), SHAKE-128-24, SHAKE-192-24 and SHAKE-256-24, limited to 224 signatures per key, with 3,856, 7,752 and 14,944-byte signatures (Table 1). The draft is not final. We build them from the experimental SP 800-230 support in slhdsa-c PR #51 (not yet merged). The code of the FIPS 205 sets in our benchmark moved to that commit too; compared with before it adds a signature-length check in verification and larger stack buffers, and the algorithms are unchanged. Without a cached hypertree, key generation and each signature rebuild a 221–222-leaf tree and take minutes. SDitH: the six v3.0 instances with cipher-based grinding (specification Table 5, *-cipherpow), from the v3.0.0 code we already benchmark; the L1 and L3 fast instances have 4,643 and 10,452-byte signatures, the others match the main instances. SMAUG-T: TiMER, the additional level-1 parameter set of the v4.0 specification (672-byte public key, 608-byte ciphertext), from its AVX2 implementation in the SMAUG-T code we already benchmark. Timings for the new sets follow from our next benchmark run. Mirath-v, Mirath KeyGen2 and RYDE-v are not added because their code has not been published.
-
Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.
Schemes: SNOVA, MAYO, QR-UOV, SQIsign, FAEST, DTRU, MAMBA-Frost
-
ISO/IEC 18033-2:2006/Amd 2:2026, published in June 2026, standardises FrodoKEM and Classic McEliece (the latter without mceliece348864). Both are now shown as ISO standards, and the ISO programme as completed.
Schemes: FrodoKEM, Classic McEliece
-
Benchmarked the round-1 candidates of China's NGCC programme on our own harness (AWS c7i.4xlarge, Intel Xeon Platinum 8488C, core cycles via rdpmc): 178 signature and 160 KEM parameter sets. Tins128/256/512 fail our sign/verify checks and are shown as not finished. We do not benchmark parameter sets that need more than 10 minutes for one signature or verification (TRINE-512-Balanced) or hours for key generation (UVW-512). A few submissions needed small fixes to their own code to run reliably; each is noted on the parameter set. The signature run also refreshes the timings of the NIST on-ramp schemes.
-
HQC v5.1 (specification, 2026-10-12, revised 2026-11-09; announcement by Bidoux) refines the decryption-failure analysis and raises the weights: ω by 1 for HQC-1, -3 and -5, and ωr by 1 for HQC-1 and -5, to offset minor cryptanalytic improvements. The decapsulation key becomes the 32-byte seed (previously 2,321, 4,602 and 7,333 bytes), the F28 polynomial changes and the XOF domain separator changes. Public keys and ciphertexts keep their sizes. We now build the v5.1.0 release (upstream KATs pass) and benchmarked it on AWS c8i.4xlarge on 2026-11-12. Key generation and encapsulation keep their speed; decapsulation is 10–17% slower (79.8→87.5, 166.9→191.0 and 322.7→377.6 µs), because it now expands the 32-byte key first.
Schemes: HQC
-
Falcon/FN-DSA: added a fixed-point version. Thomas Pornin's experimental c-fn-dsa-fx32.64 replaces floating-point arithmetic with the “type 1 fixed-point 32.64” representation of De Almeida Braga, Fouque, Lachguel and Prest, on the low-RAM structure of c-fn-dsa-alt. Keys and signatures are interoperable with c-fn-dsa; public-key and signature sizes are unchanged. We benchmark standard-mode signing without key expansion, built with the same flags as every other scheme; the floating-point version stays benchmarked from c-fn-dsa. The implementation's key-recovery and message-recovery modes are not part of any standard and are not listed.
Schemes: Falcon
-
Added the 34 signature and 41 KEM candidates of round 1 of China's NGCC programme (ICCS). Parameter sets and sizes come from our own builds of the official submission packages through the ICCS API, and claimed security targets from each specification. NGCC security targets (128, 256, 384 and 512 bits) are the programme's own scale and are not NIST levels. Timings follow once our benchmarks have run.
- (added to site ) Update Programmes: Site updates
Every signature scheme and KEM now has its own page, with its programmes, parameter sets, security flags, a version-by-version comparison of sizes and cycle counts, and its slice of this history. Scheme names in the tables and points in the charts link to it.
- (added to site ) Update Programmes: Site updates
Scheme data now records which standardisation programmes each scheme belongs to (NIST PQC, NIST on-ramp, KpqC, ISO), in preparation for tracking China's NGCC programme.
-
Ostuzzi (ePrint 2026/2247) gives the first structural forgery on MAYO: whipping amplifies polar cancellations, which the Pseudo-Oil Attack exploits, and a separate multi-target reduction uses the homogeneity of the round-2 map. For round 2 the combination lowers the estimated forgery cost of MAYO1 from 2^146 to 2^128 bit operations, 15 bits below the 2^143 required for NIST Level I, and of MAYO3 from 2^223 to 2^207, exactly at the Level III requirement (Table 5); MAYO1 is now flagged broken and MAYO3 with a warning. The round-3 linear term blocks the multi-target reduction, and the structural attack alone lowers MAYO1, MAYO2 and MAYO3 from 2^153, 2^144 and 2^223 to 2^147, 2^140 and 2^221 (Table 6). MAYO2 falls 3 bits below Level I and is flagged broken; MAYO1 is flagged with a warning; MAYO3 is not flagged.
Schemes: MAYO
-
Public-key-only universal forgery on AIM2-based AIMer (Liu, Peng, Liu, Jia, Wang, Wang & Fan, ePrint 2026/2235): BN++ checks each inverse Mersenne S-box of AIM2 through the quadratic relation t^(2^e) + γt = pt·t, which holds for any pt when the S-box output t is zero. Setting all first-layer outputs to zero and pt = ct + b^(2^e*−1), computed from the public key alone, gives a witness that satisfies every checked equation without being an AIM2 preimage; the unmodified prover then signs any message, with probability one, for every honest key of every parameter set. Forgeries were accepted by the unmodified reference verifier for AIMer-128f/192f/256f (about 11.6 ms per AIMer-256f forgery). The paper attacks the January 2026 AIM2 specification; v2.0 and v2.1 use the same relation, so we mark them broken. The AIMer team confirmed the attack, and the AIM3 relation of v3.0 rules out the zero branch. The paper also forges signatures for some Lynxer variants. v1.0 (AIM) is not covered by the paper.
Schemes: AIMer
-
Merz and Ran (ePrint 2026/2181) extend the wedge attack with divided squares of the polar forms and Schur–Macaulay matrices, removing its parameter threshold and covering odd characteristic. The attack applies to every round-2 parameter set of UOV, MAYO, SNOVA and QR-UOV but one; four alternate round-2 MAYO sets, which the site does not list, fall below their claimed level. After their disclosure the MAYO team dropped a planned round-3 set and raised the parameters of MAYO2 (see the round-3 entry of 2026-08-31). No set shown on the site falls below its level.
-
SNOVA v3.1 (specification, September 2026; code) samples the vinegar variables by rejection sampling for odd q. This removes the bias that Beullens & Hess used to recover keys of the six odd-characteristic alternative sets of v3.0; those sets keep their broken flags under v3.0. Parameters and sizes are unchanged, and the q = 16 sets sample as before. We now build v3.1 (upstream commit ebdd7e2, which also fixes table initialisation in the reference
pk_expand()) and benchmarked it on AWS c8i.4xlarge on 2026-11-12, the instance type of all other signature timings.Schemes: SNOVA
-
Key-recovery attack on SNOVA's biased vinegar sampling (Beullens & Hess, IBM Research, pqc-forum OFFICIAL COMMENT, paper to appear on ePrint): the round-3 signer draws vinegar variables by reducing uniform byte strings modulo q^g, which is never uniform when q is odd, so every signature yields noisy linear equations in the secret transformation T. Key recovery becomes a q-ary LPN problem with a known full-support error distribution, solved with BKW reduction plus Fourier hypothesis testing. This affects only the six odd-characteristic alternative parameter sets of Table 6 in the round-3 spec — (27 4 19 4 6), (27 5 13 4 4), (39 5 11 4 6), (38 5 19 4 6), (40 5 19 5 6) and (47 6 19 4 6) — all of which fall far below their claimed 170–331 bits (2^90–2^130 operations from ~6–11k signatures). Four were broken end to end against the unmodified reference implementation: 9M, 16.5M, 9M and 180M signatures recovered in 22s, 34s, 22s and 16min respectively (proof of concept). The recommended parameter sets shown here (SNOVA_{I,III,V}_{K,B,S}) use q = 16 and are unaffected, since 16^g divides 256^b exactly; no flags are changed for them. The fix is simple: sample the vinegar variables uniformly, e.g. by rejection sampling as QR-UOV does. The first version of the attack was found independently by an AI system (gpt-5.6-sol); the authors verified it, improved it and wrote it up.
Schemes: SNOVA
-
ICCS published the round-1 candidates of China's Next-generation Commercial Cryptographic Algorithms programme (NGCC): 34 signatures, 41 KEMs, 9 key exchanges and 35 hash functions. Submissions had closed on 30 June 2026. NICCS.
-
SDitH round-3 update (v3.0.0, github.com/sdith/sdith): the VOLEitH-based construction gets minor signature-size growth across all six gf2 parameter sets (Category I short/fast: 3705→3721 / 4484→4914 bytes; III: 7964→8484 / 9916→10852; V: 14121→15147 / 17540→19144), public-key sizes unchanged. Sizes verified against the tag's kat_r3 KAT vectors. A separate CIPHERPOW build variant is also introduced but not yet tracked here.
Schemes: SDitH
-
UOV round-3 parameter update (pqov/pqov): grows n at Levels I and III (Ip: n 112→119, m 44→45; III: n 184→193, m unchanged) and Level V (n 244→259, m unchanged), and adds a GFNI-optimized backend. Expanded-pk and signature sizes grow accordingly (compact-pk sizes are unchanged where m stayed fixed); Is (Level I, GF(16)) parameters are untouched. Not yet reflected on uovsig.org, which still serves the Feb-2025 round-2 package. Whether this fully re-addresses the intersection attack (Furue & Ikematsu, ePrint 2026/298) at the new parameter sizes has not been independently re-analyzed, so existing broken/warning flags are carried forward unchanged pending that analysis.
Schemes: UOV
-
HAETAE implementation 1.2.0 and the KS draft specifications 260825 (25 August 2026) and 260904 (4 September 2026), linked from the HAETAE page, revise the hyperball sampler: its discrete Gaussian CDT grows from 64 entries at 16-bit precision to 166 entries at 83-bit precision, so each sample candidate uses 203 instead of 136 random bits. The change follows a question by Jipeng Zhang (National University of Singapore) about the precision of the discrete Gaussian sampler, credited in specification 260904. Sizes are unchanged. We benchmark the 1.2.0 reference implementation (the release has no optimised code), fetched from the official download and pinned by its SHA-256; it reproduces the shipped KATs.
Schemes: HAETAE
-
SQIsign 3.0 released as the third-round submission spec: parameters revised in response to the improved supersingular isogeny-problem algorithm (ePrint 2026/1486), and the reference implementation drops its GMP dependency for a from-scratch fixed-precision integer library. Public key and signature sizes grow (level I: 65/148 → 83/200 bytes; level III: 97/224 → 129/306; level V: 129/292 → 169/406 bytes). On our benchmark (v3.0 with its x86-64 assembly field arithmetic vs. the v2.0.1 reference build) signing is faster at levels I and III (−35% / −9%) but slower at level V (+12%), and verification is 12–38% slower at every level.
Schemes: SQIsign
-
FAEST v3.0.0 released (release notes), the round-3 spec update. It restructures the VOLE-commitment construction around a new CRT-based scheme and, per issue #18, aligns the spec text for the first Fiat-Shamir challenge (
chall_1) with what the implementation already computed (no forgery or key-recovery — a transcript-binding clarification). Signature sizes shrink by roughly 10–15% across all parameter sets (e.g. 128s: 4506→4066 bytes, 256f: 26548→20856 bytes); public-key sizes are unchanged. v2.0 is not broken, just superseded as the pinned round-3 submission.Schemes: FAEST
-
QR-UOV Round 3 submission (specification, github.com/qruov/round3): the parameter set list is cut from twelve to six, all with q = 127 — the q = 31 and q = 7 sets are dropped — and three new small-public-key sets with ℓ = 10 are added (I-(127 540 60 10), III-(127 820 90 10), V-(127 1040 110 10)), e.g. an 11,041-byte public key at Level I for a 541-byte signature. The secret key is now the 32-byte seed alone at every level, and signing rejects oil systems of rank below m − 2. A new AVX2 implementation (Amagasa, Ueno & Homma, TCHES 2026(2)) replaces the Round 2 avx2/avx512 code. Benchmarks here switch to that AVX2 implementation with the AES-based public-seed PRG (upstream's default), so the speedup over Round 2 combines the new implementation with the SHAKE→AES PRG change.
Schemes: QR-UOV
-
SNOVA 3.0 (round-3 submission) reformulates the public map to support rectangular signature matrices, extending the scheme to seven parameters (v, o, q, l, r, m1, m2) and adding parameter sets over odd-characteristic fields. The recommended parameter sets (SNOVA_{I,III,V}_{K,B,S}) replace the previous v2.3 candidates; per the spec's security analysis (Tables 9–11), the Wedge product attack (Bros et al., ePrint 2026/237) that flagged several v2.3 parameter sets as broken/warning no longer applies to the reformulated public map. The “Expanded Secret Key” option is removed; only seeded secret keys remain.
Schemes: SNOVA
-
MQOM v3.0 released (round-3 spec): adds a One-Tree (OT) BLC variant alongside the existing Correlated-Tree (CT) one (tighter security reduction to the MQ problem, similar sizes, less implementation-friendly), a new gf2-shorter variant, and drops the gf256 and three-round (*-r3) variants, leaving 18 parameter sets (3 tradeoffs × 2 BLC variants × 3 categories). Fixes the salt-less GGM root-expansion issue below (ePrint 2026/1542) via domain-separated root expansion, confirmed in the spec's changelog — the v2.1 warning is dropped for v3.0. Also expands F16 parameters for additional security margin and adds ARM NEON optimized implementations.
Schemes: MQOM
-
MAYO published its round-3 spec (PDF): MAYO2's parameters change to increase its margin against the Wedge attack (Ran, ePrint 2025/1143), shrinking its public key from 4912B to 2928B while growing its signature from 186B to 239B; MAYO1 grows slightly (pk 1420→1456B, sig 454→464B) to push the improved-MQ attack (Asanuma et al., ePrint 2026/1054) margin back above the NIST Level I threshold — both flags are dropped for the round-3 parameter sets. Also adds an explicit linear term to the verification equation to block a newly disclosed claw-finding forgery attack, and fixes a low-rank weakness in the whipping schedule. MAYO3 and MAYO5 sizes are unchanged. The team also widened MAYO2's margin further in response to a new, not-yet-public UOV-like key-recovery attack privately disclosed by Lars Ran and Simon-Philipp Merz shortly before the deadline.
Schemes: MAYO
-
Delgado (ePrint 2026/1808) recovers SDitH v2 signing keys across signatures: the round-2 VOLEitH PRG runs AES or Rijndael in counter mode from zero, so every signature and leaf uses the same input and one encryption tests a candidate seed against every exposed value. With 2^12 chosen-message signatures the attack costs 11.2 to 11.7 bits less than AES key search at all six parameter sets; reduced-keyspace runs against the official code recover witnesses and produce accepted fresh signatures. The round-2 version is flagged broken. SDitH v3.0 builds its counter blocks from a tweak and the salt and is not affected.
Schemes: SDitH
-
AIMer v3.0 (specification, dated 31 July 2026) replaces AIM2 with AIM3, citing the Magic Pot attack: an IV-derived linear layer now precedes the first S-boxes (as proposed by Sun et al. for AIM2-patch) and the inverse Mersenne S-boxes become enhanced Mersenne S-boxes x^(2^e−1) + x^(2^n−2), whose quadratic relation only holds for non-zero inputs; key generation rejects keys with a zero S-box input. Parameter sets keep their names and public keys, but signatures grow by 13–25% (e.g. AIMer-128s 4,160→4,704 bytes, AIMer-256f 25,120→31,360 bytes). The specification no longer contains benchmarks, so no timings are shown for v3.0.
Schemes: AIMer
-
Ghoshal, Ishai, Jain and Sun distinguish Classic McEliece public keys from random matrices in quasipolynomial time and give a heuristic key-recovery attack of similar cost (ePrint 2026/1630; key recovery added on 27 August). Vedenev (ePrint 2026/1747), Saarinen (ePrint 2026/1786) and Weis (ePrint 2026/1984) estimate the concrete cost of key recovery. Across the five parameter sets, Weis counts 2^89 to 2^98 bit operations without a memory charge, 2^107 to 2^117 with a square-root memory charge, and 2^117 to 2^128 with the memory charge of the Classic McEliece security guide. Saarinen's itemised count, which excludes memory traffic, gives 2^127 to 2^145. Every estimate lies below the claimed category of every set (2^143 for category 1, 2^207 for category 3, 2^272 for category 5), so all sets are now flagged broken. The estimates rest on heuristic assumptions tested on small keys. Saarinen recovered the key of the TII-254 challenge code (m = 8, t = 12, n = 223; ePrint 2026/1986), but no key of a Classic McEliece parameter set has been recovered. Bernstein argues that counts of bit operations ignore the cost of moving data, which dominates these attacks. No estimate in that model has been published.
Schemes: Classic McEliece
-
Passive full-key-recovery attack on MQOM v2 (Delgado, ePrint 2026/1542): the v2.x spec derives correlated GGM roots from a fresh master seed via a fixed, zero-salt PRG call (Algorithm 10), so repeated seeds across signatures, keys, and salts leak linear equations in the MQ witness. A parity-indexed XOR-collision attack recovers the complete signing key, but requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success in Category I) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects Categories I, III, and V, verified against every official tag from v2.0.0 through v2.1.1. Fix: salt-bound, domain-separated root expansion. v1.0 unaffected. Flagged as warning.
Schemes: MQOM
-
The HAWK team withdrew HAWK from NIST's additional signature standardisation process, citing the key-recovery attack below: naïve fixes such as doubling parameters or moving to higher-rank modules make HAWK uncompetitive with other lattice signatures. NIST confirmed the withdrawal and updated the round-3 candidates page accordingly. pqc-forum announcement.
Schemes: HAWK
-
Deterministic key-recovery attack (Straznickas & Weis, Anthropic, paper) reduces HAWK-n key recovery to poly(n) calls to an exact-SVP oracle in dimension n/2+1, using a second Galois involution (τ: ζ↦−ζ) beyond the complex conjugation prior module-LIP attacks relied on. Lowers key-recovery cost from 2^150 to 2^108 gates (HAWK-512) and from 2^288 to 2^182 gates (HAWK-1024), both below their NIST level thresholds. The smaller HAWK-256 challenge parameter set was fully broken in practice: secret key recovered end-to-end in a few hours on a single 96-core server. Falcon is unaffected. Flagged as broken.
Schemes: HAWK
-
Improved algorithm for the supersingular isogeny problem (ePrint 2026/1486) achieves time/memory p^{1/3+o(1)}, down from the previous best p^{1/2}. Relies on an unproven heuristic smoothness assumption and has a superpolynomial overhead plus high memory cost; concrete impact on SQIsign's parameters not yet clarified. Flagged as warning.
Schemes: SQIsign
-
LESS v2.1 (code release v2.1.1) implements the optimised canonical forms of Beckwith, Esser, Persichetti, Santini and Zweydinger (ePrint 2025/1424, TCHES 2025). The parameter sets and sizes are those of the round-2 specification v2.0; signatures differ, so the known-answer tests changed. There is no new specification document. We build its AVX2 implementation and keep our timings of the round-2 code for v2.0. On AWS c8i.4xlarge, v2.1 signs 22% to 35% faster and verifies 23% to 42% faster than v2.0 (LESS-252-192: signing 61.6 to 40.1 ms, verification 58.4 to 33.9 ms).
Schemes: LESS
- Update Programmes: Site updates
Published a standalone KEMs comparison page — public-key and ciphertext sizes plus keygen/encaps/decaps benchmarks for ML-KEM, HQC, and classical ECDH.
-
Improved MQ attack (Asanuma, Chen, Furue, Sakata & Takagi, ePrint 2026/1054) reduces MAYO1 classical security estimate from 2^156 to 2^145. Still above NIST Level I threshold (128 bits); flagged as warning.
Schemes: MAYO
-
Updated FAEST performance data to use the AVX2+AES-NI optimized implementation (faest-arch-opt) instead of the reference implementation. Signing is 10–100× faster depending on the parameter set.
Schemes: FAEST
-
Updated SNOVA to v2.3 (2026-04-03). Split round-2 and round-3 data: round-3 now shows the 14 current parameter sets from the v2.3 spec (l=4 variants retained with warnings, new q=19 variants, rectangular 4×5 structure added per "Rectangular signatures" update).
Schemes: SNOVA
-
Updated UOV security flags based on pℓ-truncated polynomial ring intersection attack (Furue & Ikematsu, ePrint 2026/298). Improves on Ran's wedge attack for Ip (~128 bits), III (~182 bits), V (~223 bits). Is parameter sets newly flagged as warning (~159 bits, still above threshold).
Schemes: UOV
-
Updated UOV and MAYO security flags based on wedge attack (Ran, ePrint 2025/1143). MAYO-2 ("two") marked broken (~113 bits, below 128-bit threshold). UOV Ip, III, and V parameter sets marked with warning (reduced but still above threshold). UOV Is unaffected.
-
Updated SNOVA security flags based on wedge product attack (Bros et al., ePrint 2026/237). 6 parameter sets marked broken: (37 17 2), (25 8 3), (56 25 2), (24 5 5), (75 33 2), (29 6 5). 2 parameter sets marked with warning: (24 5 4), (37 8 4).
Schemes: SNOVA
-
Updated 7 schemes to their latest published specifications. PERK redesigned parameter sets (v2.2.0). MQOM adds gf16 variants (v2.1). RYDE and Mirath corrected signature sizes and added faster variants. CROSS, SQIsign, and MAYO updated with revised benchmarks.
-
Magic Pot (Biryukov, García Fernández & Udovenko, ePrint 2026/903, EUROCRYPT 2026): a new algebraic elimination framework recovers AIM2 keys from a single public key in 2^103.66, 2^147.46 and 2^213.19 encryptions for AIM2-I, -III and -V, below the claimed 128, 192 and 256 bits. If one secret key is reused under several IVs, or keys are related, key recovery becomes practical and was run: 11, 20 and 52 public keys in about 33, 30 and 37 hours. This affects AIMer v2.0 and v2.1; the AIMer team replaced AIM2 by AIM3 in v3.0 in response.
Schemes: AIMer
- Update Programmes: Site updates
Fixed some typos in scheme data. commit
- Update Programmes: Site updates
Website rewritten with SvelteKit, Tailwind CSS v4, and a new round selector, filter panel, and scatter plot.
-
HAETAE KS draft specification 260204 with implementation 1.1.2 (CryptoLabInc/HAETAE), prepared for Korean standardisation, renames the parameter sets HAETAE-120/180/260 to HAETAE-2/3/5 after their NIST levels. Sizes are those of v3.0.
Schemes: HAETAE
-
Sun, Chen, Liu, Wang & Niu (ePrint 2025/2272) give resultant-based algebraic attacks on AIM2: 2^188.76 primitive calls for AIM2-III with ω = 2 (2^195.05 with ω = 2.373), against 192 claimed bits, and 2^295.97 for AIM2-V via subfield reduction, about 2^100 below the designers’ Gröbner-basis estimate but above 256 bits. They propose AIM2-patch, which adds a linear layer after the key. The AIMer team’s January 2026 specification counts these attacks at more than an exhaustive search of AES at the same level. No flag change.
Schemes: AIMer
-
KpqC announced its final algorithms: AIMer and HAETAE (signatures), NTRU+ and SMAUG-T (KEMs). AIMer was then at v2.1.
-
AIMer v2.1 (specification, announcement): implementation-only changes (PQClean compatibility, a memory-optimised C implementation, ARM SHAKE optimisation, and constant-time patches recommended by D. J. Bernstein). Sizes are unchanged from v2.0.
Schemes: AIMer
-
HAETAE v3.0 (specification) corrects the secret-key sizes, which were missing 32 bytes (HAETAE-120 1,376→1,408 bytes), lowers B′ by 0.01 to satisfy Lemma 5, and replaces the 512-point FFT in key generation by a 256-point FFT (40–60% fewer key-generation cycles in AVX2). This is the version KpqC selected in January 2025.
Schemes: HAETAE
-
AIMer v2.0 (specification), the KpqC round-2 submission, replaces AIM with AIM2 (Kim, Ha, Son & Lee, ePrint 2023/1474) to counter the 2023 attacks on AIM: inverse Mersenne S-boxes in the first round and a distinct constant added before each S-box. It also halves the salt, adds message pre-hashing and cuts the twelve parameter sets to six (AIMer-128f/s, -192f/s, -256f/s). Signatures at the same level are similar in size to v1.0 (e.g. 4,160 bytes for AIMer-128s against 4,176 bytes for L1_PARAM3).
Schemes: AIMer
-
HAETAE v2.1 (specification) adds an HVZK argument for compressed HAETAE, a precise security bound with refined MLWE estimates, and a list of reported attacks and fixes. Parameters and sizes are unchanged.
Schemes: HAETAE
-
HAETAE v2.0 (specification), the KpqC round-2 submission, fixes the implementation errors behind the buffer-overflow (Saarinen) and rANS bit-flipping (HuFu team) forgeries of v1.0 and an uninitialised sum in the hyperball sampler, and changes the HAETAE-120/180 parameters to account for verification-key compression: signatures grow from 1,463/2,337/2,908 to 1,474/2,349/2,948 bytes. It adds AVX2 and Cortex-M4 implementations.
Schemes: HAETAE
-
Zhang, Wang, Yu, Guo & Cui (ePrint 2023/1397, ASIACRYPT 2023) attack full AIM-III in 2^186.5 encryptions, below its 192-bit target, by exploiting the algebraic structure of its power-function S-boxes.
Schemes: AIMer
-
Liu, Mahzoun, Øygarden & Meier (ePrint 2023/1133, ToSC 2023(4)) find equivalent representations of full AIM that admit fast exhaustive search, recovering AIM-I/III/V keys in 2^136.2/2^200.7/2^265 bit operations, about 2^115/2^178/2^241 AIM evaluations. AIM therefore misses the NIST levels claimed by AIMer v1.0.
Schemes: AIMer