Laurus-XOF and Laurus-512 coincide on 1024 message lengths
Holds · Demonstrated · Cause: construction
Property: domain separation between the hash and the XOF
Cost against claim: relation between two named functions; no claimed property of either falls
For every message of 1537 to 2560 bits (exactly two absorbed blocks), Laurus-XOF(M, 512) = Laurus-512(M), and longer XOF outputs extend that digest. The two functions are separated only by one bit of the initial state; that bit sits in the part of the state that bypasses the permutation, moves 512 bits per block and, after two blocks, lands in the part that finalisation discards.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| Laurus-XOF / Laurus-512 | separated functions | none | Holds |
Evidence
Measured on the reference code, with the official test vectors reproduced: equal for all 1024 lengths in [1537, 2560], unequal for every other length up to 5000 bits.
Cause in the specification, traced to the specification text.
Limits
Not a collision or preimage of either function; it contradicts the stated purpose of the separating bit.
Credit
Found by PQC-X.
Related public reports:
- Tsinghua Hash Lab (ngcc.dev hash-14-1, 2026-09-22): the same separating bit fails in the generic interface at c = 1024; the named XOF and Laurus-512 use c = 512, which this entry covers.