PQC-XXJTLU · cryptanalysis

HomeHash functions › Eijen

Hash function · symmetric (hash)

Eijen

Design

eijen-1

Eijen-h is the last h bits of a longer Eijen for one-block messages

Holds · Demonstrated · Cause: construction

Property: separation between instances

Cost against claim: relation between instances; no claimed property falls

For one-block messages the starting state does not depend on the rate or the capacity, and each digest length is at most the capacity, so Eijen-h(M) is the suffix of Eijen-h′(M). It holds for all 10 pairs of sizes, for every length up to one block, and for no longer length.

Parameter setClaimAttack costVerdict
all 10 pairs of Eijen sizesno claim of separation between instancesnoneHolds

Evidence

On the official test vectors, and on a model rebuilt from the specification.

Cause in the specification: the attack also works on a model built from the specification alone.

Credit

Found by PQC-X.

Related public reports:

Implementation

Bugs in the submitted code; the specification is sound on these points.

eijen-i1

The submitted code pads a 7-bit tail like a full byte: H(X) = H(X‖0000000)

Minor break · Demonstrated · Cause: code

Property: collision resistance of the submitted function

Cost against claim: 1 evaluation, against 2128 to 2512

Through the NGCC interface, a byte-aligned message is padded with 0x01 and a message ending in a 7-bit tail is padded with 0x80 >> 7, which is also 0x01. Every byte string X therefore collides with X followed by seven zero bits, for every size. The specified padding is injective under every reading of its bit order; the test-vector rule mixes two bit-order conventions and matches none of them.

Parameter setClaimAttack costVerdict
all five Eijen sizescollision 2128 to 25121 evaluationMinor break

Evidence

Cause in the submitted code; the specification is not affected.

Limits

Byte-oriented callers never produce the colliding pairs; the NGCC bit-level interface does. The one-line fix changes 3566 of the 4097 official test vectors of each size. Separately, the specified feed-forward includes the final flag while the code, the test vectors and the specification's own printed digests do not, so an implementation written from the specification matches no official test vector.

Designers' response

The designers published an update that changes the padding to a full pad10*1 in one bit order and injects the digest length at finalisation, with new test vectors (CryptHash forum, 2026-09-22). PQC-X has not checked it.

Credit

First public report: M.-J. Saarinen (ngcc.dev hash-09-1, 2026-09-21). Found independently by PQC-X.