MoFang

Equivalent message blocks: collisions and second preimages for free

Practical · Demonstrated · Cause: construction

Property: collision and second-preimage resistance

Cost against claim: 2 evaluations, probability 1, against 2¹²⁸ to 2⁵¹² (collision) and 2²⁵⁶ to 2¹⁰²⁴ (second preimage)

Each 1152-bit message block is used as a block-cipher key. XORing a fixed two-periodic pattern into two matching words of the two block halves leaves every round key unchanged, whatever the chaining value. The two blocks define the same permutation, so a message and its modified copy always have the same digest.

What causes it

• The key-expansion S-box is applied to row 0 only.
• Both word transpositions contain a 2-cycle that never visits row 0, and every rotation amount on that cycle is odd.
• The round-key blocks are combined by XOR only.

A period-2 pattern placed in the same word of both halves therefore evolves identically in the two halves and cancels in the whitening key and in all 16 round keys. The designers' security argument assumes an ideal cipher; this is a key collision of probability 1.

Evidence

• A model rebuilt from the specification alone reproduces all 24,582 official test-vector entries, and gives 1800/1800 collisions over every instance and pattern under every reading the specification's inconsistencies allow (S-box, rotation direction, key schedule, whitening).
• On the unmodified reference code: 2000/2000 collisions per instance, and a second preimage of the official 4096-bit test-vector message that hashes to the official digest.

Cause in the specification: the attack also works on a model built from the specification alone.

Limits

Messages must be at least 960 bits long. First-preimage resistance is not affected.

Credit

First public report: Cryptanalysts001 (ISCAS) (CryptHash forum, 2026-09-22). Found independently by PQC-X.

Related public reports:

• Tsinghua Hash Lab (ngcc.dev hash-19-1, 2026-09-22): the same collisions found independently the same day, with same-length second preimages and multicollisions.
• Y. Yuan et al. (ISCAS, UCAS) (ePrint 2026/2152, 2026-09-22): the collisions, in a paper on seven NGCC hash functions.

MoFang-768 is MoFang-1024 with its halves swapped and cut, for one-block messages

Holds · Demonstrated · Cause: construction

Property: separation between instances

Cost against claim: relation between two instances; no claimed property falls

For every message shorter than one block (1152 bits), the MoFang-768 digest equals the MoFang-1024 digest with its two halves swapped and each cut to 384 bits. Checked on all 1152 official test-vector lengths below one block.

Evidence

Cause in the specification: the attack also works on a model built from the specification alone.

Credit

Found by PQC-X.