The decryption-failure rate of Loong128 and Loong256 is 2-92 and 2-84, not 2-141 and 2-161: a first failure fits within the call's 280 decapsulations
Security proof gap · Argued · Cause: parameter size
Property: IND-CCA security (the designers' argument)
Cost against claim: failure rate 2-91.8 and 2-84.4 against 2-141 and 2-161 claimed; a first failure within 280 queries
The specification's failure analysis gives the rounding errors of the compressed public key and ciphertext the variance of the centred binomial distribution, whereas dropping 3 of the 13 bits of a coefficient leaves a uniform error with a second moment more than twice as large. Computed exactly, with the noise checked on the reference code, a decryption fails with probability 2-91.8 at Loong128 and 2-84.4 at Loong256, about 249 and 277 times more often than the claimed 2-141 and 2-161. An attacker who keeps only the ciphertexts whose known randomness is largest sees a first failure within 279.8 decapsulation queries, at about 294.8 (Loong128) and 285.3 (Loong256) offline work, so the argument that failures stay out of reach no longer establishes IND-CCA security at these two levels; turning failures into key recovery has not been costed, and no attack below the claim is known.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| Loong128 | failure rate 2-141 (Table 2); IND-CCA at 128 bits | failure rate 2-91.8; a first failure after 279.8 queries on selected ciphertexts, with 294.8 offline work; key recovery not costed | Security proof gap |
| Loong256 | failure rate 2-161 (Table 2); IND-CCA at 256 bits | failure rate 2-84.4; a first failure after 279.8 queries on selected ciphertexts, with 285.3 offline work; key recovery not costed | Security proof gap |
What causes it
Section 2.2.3 ("Probability of Decryption Failure") writes each noise coordinate as four inner products of n-dimensional vectors plus the terms e5 and e6, then models the six vectors r̂, ŝ, ê1, ê2, ê3, ê4 as Gaussian with variance σ² = η/2. Two of them, ê2 and ê4, are not binomial: they are the rounding errors of the public key (db bits kept) and of the ciphertext parts u and U (du bits kept), uniform on 8 values when 3 bits are dropped (db = du = 10 at Loong128 and Loong256), second moment 5.5, and on 4 values when 2 are (db = du = 11 at Loong384 and Loong512), second moment 1.5, against the η/2 = 2.5, 2.0, 1.5 and 1.0 the analysis uses. Table 2's rates follow from that formula once each product is given the standard deviation η/2 its authors evidently intended (read literally, with σ = √(η/2), it gives 2-365 at Loong128); correcting the two second moments alone brings it within a few bits of the exact rate, and at Loong384 the two moments coincide, which is why only that set's figure is right. The worst-case treatment of the V-rounding term e6 is conservative and is not the cause. Theorem 2 (§5.1) bounds the IND-CCA advantage by a term q_H·δ that the true rates push above 1 inside the hash-query counts these levels allow. The reference code implements the specified compression, so the noise it produces is the specification's.
Evidence
Nothing was run at the scale of a failure: the rates are exact tail computations under an independence model, and the model's noise was checked on the reference code. PQC-X instrumented the reference decryption of Loong128, Loong256 and Loong512 to record the noise term of V′ − W over 230 000 to 512 000 coordinates per set: standard deviations 216.7, 183.4 and 180.8 against 216.4, 183.3 and 180.7 predicted, and no failure observed, as expected at these rates. A second member of PQC-X re-ran those scripts (identical outputs), re-derived the four rates by a different method (exponential tilting and an FFT convolution of the exact per-coordinate distribution, then a union bound over the N² coordinates): 2-91.8, 2-84.4, 2-191.6 and 2-212.1; re-measured the noise on a fresh copy of the unmodified code (217.0 over 432 000 coordinates at Loong128, 183.0 over 512 000 at Loong256, no failure); and reproduced Table 2 from the specification's own formula to within 1.5 bits, which locates the discrepancy in the two rounding moments. The same member estimated the ciphertext selection with a Gaussian-conditional model: keeping the 2-14.9 (Loong128) or 2-5.5 (Loong256) fraction of ciphertexts whose known randomness is largest raises the failure rate per query to 2-79.8.
Cause in the specification: the attack also works on a model built from the specification alone.
Limits
No failure was observed and no key recovery was attempted: the step from observed failures to the secret key (directional failure boosting, then lattice reduction with the hints the failures give, as in D'Anvers, Rossi and Virdia, EUROCRYPT 2020) has not been costed, so no attack below the claim is known. The selection figures come from a rough Gaussian-conditional model, not from a run. At Loong384 the claimed rate is accurate (2-191.6 against 2-190); at Loong512 the true rate is 2-212.1 against the claimed 2-260. In the same selection model a first failure still needs about 2168 queries at Loong384 and 2190 at Loong512, far beyond the 280 the call allows, so the argument stands at those two levels.
Credit
Found by PQC-X.
Failure boosting: D'Anvers et al., PKC 2019; key recovery from decryption failures: D'Anvers, Rossi and Virdia, EUROCRYPT 2020.