eijen-1
Eijen-h is the last h bits of a longer Eijen for one-block messages
Holds · Demonstrated · Cause: construction
Property: separation between instances
Cost against claim: relation between instances; no claimed property falls
For one-block messages the starting state does not depend on the rate or the capacity, and each digest length is at most the capacity, so Eijen-h(M) is the suffix of Eijen-h′(M). It holds for all 10 pairs of sizes, for every length up to one block, and for no longer length.
| Parameter set | Claim | Attack cost | Verdict |
|---|
| all 10 pairs of Eijen sizes | no claim of separation between instances | none | Holds |
Evidence
On the official test vectors, and on a model rebuilt from the specification.
Cause in the specification: the attack also works on a model built from the specification alone.
Credit
Found by PQC-X.
Related public reports:
- Tsinghua Hash Lab (ngcc.dev hash-09-2, 2026-09-22): a related three-block relation between the 512-, 768- and 1024-bit instances.
Bugs in the submitted code; the specification is sound on these points.
eijen-i1
The submitted code pads a 7-bit tail like a full byte: H(X) = H(X‖0000000)
Minor break · Demonstrated · Cause: code
Property: collision resistance of the submitted function
Cost against claim: 1 evaluation, against 2128 to 2512
Through the NGCC interface, a byte-aligned message is padded with 0x01 and a message ending in a 7-bit tail is padded with 0x80 >> 7, which is also 0x01. Every byte string X therefore collides with X followed by seven zero bits, for every size. The specified padding is injective under every reading of its bit order; the test-vector rule mixes two bit-order conventions and matches none of them.
| Parameter set | Claim | Attack cost | Verdict |
|---|
| all five Eijen sizes | collision 2128 to 2512 | 1 evaluation | Minor break |
Evidence
- Exhaustive over all messages of 0 to 16 bits: the collisions of the test-vector rule are exactly the pairs (X, X‖07).
- 2000/2000 collisions per size on the reference code; the official 1711-bit test-vector message and its 1704-bit prefix both give the official digest.
Cause in the submitted code; the specification is not affected.
Limits
Byte-oriented callers never produce the colliding pairs; the NGCC bit-level interface does. The one-line fix changes 3566 of the 4097 official test vectors of each size. Separately, the specified feed-forward includes the final flag while the code, the test vectors and the specification's own printed digests do not, so an implementation written from the specification matches no official test vector.
Designers' response
The designers published an update that changes the padding to a full pad10*1 in one bit order and injects the digest length at finalisation, with new test vectors (CryptHash forum, 2026-09-22). PQC-X has not checked it.
Credit
First public report: M.-J. Saarinen (ngcc.dev hash-09-1, 2026-09-21). Found independently by PQC-X.