feilian-i1
The digest depends on bits beyond the stated message length
Holds · Demonstrated · Cause: code
Property: determinism of the interface; no claimed property shown to fall
Cost against claim: two callers holding the same message can get different digests
When the bit length is not a multiple of 8, the submitted FEILIAN code lets the unused bits of the last byte change the digest.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| FEILIAN, bit-granular inputs | digest of the stated message | none | Holds |
Evidence
Found by fuzzing the reference code through the NGCC interface, 20/20.
Cause in the submitted code; the specification is not affected.
Credit
Found by PQC-X.