DOVE

Verification never reads the salt

Security proof gap · Argued · Cause: specification text

Property: strong unforgeability, and the proof's model

Cost against claim: malleable signatures; the proof analyses a different algorithm

The specified signing and verification compute their target from the message and the public seed, and verification never reads the salt carried in the signature. Any salt bit can be flipped without invalidating a signature, and the security analysis, written for a target that depends on the salt, does not describe the specified algorithm.

Evidence

Cause in the specification, traced to the specification text.

Limits

Malleability alone breaks no claimed property. With SM3 itself, a collision of its 256-bit internal state gives two messages the same target, hence a forgery in about 2¹²⁸ at levels 256 and 512; that limit belongs to the call's placeholder hash and is not counted here.

Credit

First public report: Dariia Porechna (ngcc.dev sign-09-1, 2026-09-22). Found independently by PQC-X.

Related public reports:

• Dariia Porechna (ngcc-harness issue 9, 2026-09-22): the forgery in about 2¹²⁸ at levels 256 and 512 through SM3; not counted, see Limits.

DOVE-128 meets its level with no margin

Holds · Argued · Cause: parameter size

Property: existential unforgeability

Cost against claim: binding attack 2^128.4 against 2¹²⁸

No attack below the requirement was found, but the best ones sit on it: a binding attack at 2^128.4 and a direct forgery at 2^129.2 (ω = 2), where the call asks for security redundancy.

Evidence

Cause in the specification, traced to the specification text.

Credit

Found by PQC-X.