mamba-viper-1
A 256-bit re-encryption coin at every level caps MAMBA-Viper-384 and -512 at 2256
Minor break · Tested at small scale · Cause: parameter size
Property: IND-CCA security
Cost against claim: session key security 2256 classical, about 2128 quantum, against 384 and 512
Algorithm 4 (PKE.Enc) fixes the re-encryption coin σ at 256 bits at every profile, including Viper-384 and Viper-512, instead of scaling it with the target level. The encapsulated session key K is a function of (pk, ct, σ) at all four levels (Algorithm 7), so guessing σ, redoing encryption and comparing against the public ciphertext bounds any attacker's work at 2256 classical trials, about 2127.65 Grover iterations, whatever the lattice dimension. The lattice problem itself stays far above the target at 384 and 512, so σ is the binding limit, not the ring.
| Parameter set | Claim | Attack cost | Verdict |
|---|
| MAMBA-Viper-384 | 384 classical, 192 quantum | 2256 classical; about 2128 Grover iterations | Minor break |
| MAMBA-Viper-512 | 512 classical, 256 quantum | 2256 classical; about 2128 Grover iterations | Minor break |
What causes it
Spec p.8, Algorithm 4, step 1 parses the 512-bit coin ω into σ, µ ∈ {0,1}^256 × {0,1}^256 at every set; step 4 derives r from σ alone via GenSecret. Algorithm 7 (p.10) sets K = H_ℓK(K̂, H(ct)) with K̂ from G(h_pk, m), so the session key inherits σ's 256 bits. Theorem 6.1 (p.19), the designers' own bound, contains an Adv_XOF term for expanding r from its seed; a 2256-time distinguisher drives that term to 1, so the theorem itself proves nothing past 2256 at 384 and 512.
Evidence
Fresh reference builds for all four levels reproduced both official KAT copies byte for byte (SHA-256 match). A harness that instruments only the RNG glue, linked against the unmodified core, confirmed at every level that the ciphertext depends on exactly 256 bits of σ: complementing σ[32:ss-1] left it unchanged, flipping σ[0] or σ[31] changed it (viper.c:421-437). From (pk, ct) and a 32-byte σ alone, the full decapsulation check passes and the derived key matches the honest one at all four levels; none of 4096 wrong 32-byte guesses passed the check. The attacker's own demo, re-run unmodified against the fresh builds, reproduced the same candidates as their log. Grover cost was computed with a cost model stated in its script: 2127.65 iterations, about 2149.4 to 2149.7 Toffoli. A second PQC-X verifier reread Algorithm 4 and Theorem 6.1, rebuilt the harness independently and confirmed the same 256-bit dependence and the same cost at every level.
Cause in the specification, traced to the specification text.
Limits
Under NIST's MAXDEPTH quantum cost model, the 384 set's quantum shortfall holds only in iteration count, or with no depth bound (about 2248/2224/2192 gates at the three depth caps, not below the 192-bit quantum target); the 512 set stays below its 256-bit quantum target at every depth cap. The classical shortfall, which carries the finding, is unaffected by the depth model at either set.
Credit
Found by PQC-X.
Bugs in the submitted code; the specification is sound on these points.
mamba-viper-i1
A 32-byte seed for the long-term secret caps MAMBA-Viper-384 and -512 at 2256
Minor break · Tested at small scale · Cause: code
Property: key recovery
Cost against claim: key recovery 2256 classical, about 2128 quantum, against 384 and 512
The submitted code draws the long-term secret s from a fixed 32-byte seed at every level: kem.c calls randombytes(sseed, 32) and rebuilds s from it byte for byte, the same in all four API_PKC instances (Reference and Optimized, both trees) and in the Native Implementation. Guessing the 32-byte seed, regenerating s and the public key and decapsulating an honest ciphertext identifies the right guess deterministically, so no key at Viper-384 or Viper-512 costs more than 2256 classical trials, about 2128 Grover iterations, to recover.
| Parameter set | Claim | Attack cost | Verdict |
|---|
| MAMBA-Viper-384 | 384 classical, 192 quantum | 2256 classical; about 2128 Grover iterations | Minor break |
| MAMBA-Viper-512 | 512 classical, 256 quantum | 2256 classical; about 2128 Grover iterations | Minor break |
What causes it
Spec Algorithm 3 (p.8), step 3 samples the secret s ← B_ηs^k directly, with no seed; Theorem 6.1 (p.19) lets Adv_XOF cover (A, d_pk), (d_u, d_v) and r, but not s, and Appendix C's Fig. 1 (p.31 to 32) samples s ideally. Section 8.6 (p.25) only says the implementation "expands a seed" for the long-term and ephemeral secrets, with no length fixed. The code fixes that length at 32 bytes: kem.c:21-24 (randombytes(sseed, 32), then viper_pke_keypair) and viper.c:495-501 and 421-437 for the expansion, identical across every profile and both implementation trees.
Evidence
From the 32 recorded seed bytes and the public ρ alone, PKE.KeyGen rebuilt pk and the stored s byte for byte at all four levels; a secret key rebuilt from them decapsulated the honest ciphertext correctly. None of 4096 wrong 32-byte seeds reproduced the public b. The attacker's own demo, route (b), re-run unmodified against the fresh builds, reproduced the same candidates as their log with the key rebuilt from the seed. The oracle cost is the same as the re-encryption coin's: 2256 classical trials, 2127.65 Grover iterations. A second PQC-X verifier reread section 8.6 and Theorem 6.1, checked the same 32-byte call in the Native Implementation tree independently, and confirmed the rebuild at all four levels.
Cause in the submitted code; the specification is not affected.
Limits
At Viper-256 the 32-byte seed equals the claimed level exactly, 2256 classical with zero margin, not a break; at Viper-128 and Viper-192 the 256-bit seed exceeds the target, so this does not weaken those sets. At 384 and 512, this finding rides the same 256-bit ceiling as the re-encryption coin finding on this candidate: the two share a root cause in the amount of entropy the code carries forward from a seed, one in the specification, the other only in the code.
Credit
First public report: M.-J. Saarinen (ngcc.dev kem-21-1, 2026-09-23). Found independently by PQC-X.