ZC-DMC

A one-slice iterative differential on ZC-1536

Theoretical · Tested at small scale · Cause: construction

Property: collision resistance

Cost against claim: ZC-DMC-1536-512 collision ≈2¹⁰⁷ against 2²⁵⁶

In the ZC-1536 permutation, the step ρ shifts plane 2 without any rotation along z. A difference confined to one slice, in planes 0 and 2 with even column parities, passes θ untouched and stays in its slice. The pattern iterates at about 2^-12 per round (2^-10.3 for the whole cluster of trails), and the Davies-Meyer feed-forward (capacity-only in ZC-DMC) cancels one plane of the output difference, which yields digest or inner collisions.

What causes it

The offset of plane 2 in ρ has no z-component. The designers name this very risk (differences confined to a small slice) and add lane-wise rotations to ρ against it, but plane 2 got a zero z-offset.

Evidence

• Real 3- and 4-round collisions in the actual ZC-DMC mode, for the 512- and 768-bit instances.
• Every 1-, 2- and 3-round probability measured and matched by an exact Markov model; the per-round probability re-measured on the reference round function (2^-12.02). Rounds 5 to 12 are extrapolated.
• A model rebuilt from the specification reproduces every official test vector of the six 1536-bit instances.

Cause in the specification: the attack also works on a model built from the specification alone.

Limits

Even at the least favourable rate (plain difference distribution table, worst case), every figure stays at least 80 bits (512) and 200 bits (768) below its claim. Not affected: the 1024-bit instances (the characteristic cannot be entered from the rate), every ZC-1280 instance (every ρ offset has a z-rotation), and ZC-EDMC.

Credit

Found by PQC-X.

Related public reports:

• Tsinghua Hash Lab (ngcc.dev hash-31-1, 2026-09-22): a different result: a distinguisher between the ZC-DMC-1536-512 and -768 profiles.