Hash functions · cryptanalysis

Attacks whose cause lies in the specification of a candidate, rated by what they actually cost against what the designers claim and what the call requires.

Implementation vulnerabilities page →

Practical: The construction itself is broken, at a classical cost of at most 2⁸⁰ in the unit of the claim.
Theoretical: The construction itself is broken, below the claim, but the attack is out of reach.
Minor break: A claim falls, but the designers fix it locally (a size, a missing check, a code bug), or only a secondary property falls.
Security proof gap: The security argument does not establish the claim, and no attack is known.

Feasibility. Demonstrated: run on the real parameters. Tested at small scale: run on a smaller instance, the real cost extrapolated. Argued: from an argument or an exact computation.

PQC-XAll findings

10 breaks: 4 practical, 2 theoretical, 4 minor; 4 demonstrated. 1 security proof gap.

Practical (4)

Verdict	Candidate	Finding	Feasibility	Credit
Practical	MoFangHash · symmetric	Collisions and second preimages, at no cost	Demonstrated	PQC-X · first public: Cryptanalysts001 (ISCAS)
Practical	NeulaserHash · symmetric	Collisions and second preimages	Demonstrated	PQC-X^* · first public: Cryptanalysts001 (ISCAS)*PQC-X adds: second preimages
Practical	CHAMPHash · symmetric	Collisions	Tested at small scale	PQC-X · first public: M.-J. Saarinen
Practical	CHIMEHash · symmetric	Collisions	Tested at small scale	PQC-X^* · first public: Cryptanalysts001 (ISCAS)*PQC-X adds: subset collisions found, tighter bound

Theoretical (2)

Verdict	Candidate	Finding	Feasibility	Credit
Theoretical	ZC-DMHash · symmetric	Collisions	Tested at small scale	PQC-X
Theoretical	ZC-DMCHash · symmetric	Collisions	Tested at small scale	PQC-X

Minor break (4)

Verdict	Candidate	Finding	Feasibility	Credit
Minor break	CHAMPHash · symmetric	Short inputs recovered from the digest	Demonstrated	PQC-X
Minor break	uHashHash · symmetric	Length extension	Demonstrated	PQC-X
Minor break	AXISHash · symmetric	Second-preimage claim above the generic bound	Argued	PQC-X
Minor break	uHashHash · symmetric	Second-preimage claim above the generic bound	Argued	PQC-X

Security proof gap (1)

Verdict	Candidate	Finding	Feasibility	Credit
Security proof gap	MasterCubeHash · symmetric	Security argument covers neither version	Demonstrated	PQC-X · first public: Cryptanalysts001 (ISCAS)

38 findings on 18 candidates: 16 by PQC-X and 22 published by other teams, from 8 authors or groups; 19 breaks by the site's rules.

A public finding is cited as its authors published it: the title is theirs and the link leads to their page. Its verdict is PQC-X's, computed by the same rules as for its own findings from what the report states; PQC-X has not reproduced it. 7 public reports that PQC-X reproduced or found independently are listed once, under PQC-X. Other teams' pages last checked on 2026-09-24.

Practical (9)

Verdict	Candidate	Finding	By
Practical	CHAMPHash · symmetric	Collisions	PQC-X · first public: M.-J. Saarinen
Practical	CHIMEHash · symmetric	Collisions	PQC-X^* · first public: Cryptanalysts001 (ISCAS)*PQC-X adds: subset collisions found, tighter bound
Practical	CHIMEHash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
Practical	MoFangHash · symmetric	Collisions and second preimages, at no cost	PQC-X · first public: Cryptanalysts001 (ISCAS)
Practical	MoFangHash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
Practical	MoFangHash · symmetric	Round-key cancellation gives deterministic full-round collisionsngcc.dev hash-19-1	Tsinghua Hash Lab2026-09-22
Practical	NeulaserHash · symmetric	Collisions and second preimages	PQC-X^* · first public: Cryptanalysts001 (ISCAS)*PQC-X adds: second preimages
Practical	NeulaserHash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
Practical	NeulaserHash · symmetric	Reduction modulo 2^32-5 creates reachable state mergersngcc.dev hash-21-2	Tsinghua Hash Lab2026-09-22

Theoretical (3)

Verdict	Candidate	Finding	By
Theoretical	CHAMPHash · symmetric	Known-length preimages admit an exact square-root searchngcc.dev hash-04-3	Mounir IDRASSI2026-09-22
Theoretical	ZC-DMHash · symmetric	Collisions	PQC-X
Theoretical	ZC-DMCHash · symmetric	Collisions	PQC-X

Minor break (7)

Verdict	Candidate	Finding	By
Minor break	AXISHash · symmetric	Second-preimage claim above the generic bound	PQC-X
Minor break	CHAMPHash · symmetric	Short inputs recovered from the digest	PQC-X
Minor break	CHAMPHash · symmetric	Fixed-length outputs occupy only one determinant fiberngcc.dev hash-04-1	Markku-Juhani O. Saarinen2026-09-21
Minor break	CHAMPHash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
Minor break	MEGASCONHash · symmetric	The AVX-512 listing defines a noninjective S-box and practical collisionsngcc.dev hash-18-2	Cryptanalysts001 (ISCAS)2026-09-22
Minor break	uHashHash · symmetric	Length extension	PQC-X
Minor break	uHashHash · symmetric	Second-preimage claim above the generic bound	PQC-X

Security proof gap (1)

Verdict	Candidate	Finding	By
Security proof gap	MasterCubeHash · symmetric	Security argument covers neither version	PQC-X · first public: Cryptanalysts001 (ISCAS)

Observations (18)

No claimed or required property falls, or the report establishes nothing yet; a limit of the placeholder hash is marked "not counted".

Candidate	Finding	By
CHAMPHash · symmetric	Public comment on CHAMP: commuting matrices and a birthday over projective labelsCryptHash forum	Tsinghua Hash Lab2026-09-22
CuishenHash · symmetric	Public comment on Cuishen: an invariant subspace of the message expansionCryptHash forum	Cryptanalysts001 (ISCAS)2026-09-22
CuishenHash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
EijenHash · symmetric	Eijen-h is the last h bits of a longer Eijen for one-block messages	PQC-X
EijenHash · symmetric	Cross-instance three-block relationsngcc.dev hash-09-2	Tsinghua Hash Lab2026-09-22
IpheHash · symmetric	Cross-profile 512-bit output relationngcc.dev hash-12-1	Iphe Algorithm Group2026-09-23
LaurusHash · symmetric	Laurus-XOF and Laurus-512 coincide on 1024 message lengths	PQC-X
LaurusHash · symmetric	Laurus loses its function-domain separation at c=1024ngcc.dev hash-14-1	Tsinghua Hash Lab2026-09-22
MEGASCONHash · symmetric	The 384-bit digest is a prefix of the 512-bit digest for short messages	PQC-X · first public: M.-J. Saarinen
MoFangHash · symmetric	MoFang-768 is MoFang-1024 with its halves swapped and cut, for one-block messages	PQC-X
MOZIHash · symmetric	The 384-bit digest is a prefix of the 512-bit digest for short messages	PQC-X · first public: M.-J. Saarinen
MOZIHash · symmetric	The specified final marker creates cross-rate relations absent from the implementationngcc.dev hash-20-2	Tsinghua Hash Lab2026-09-22
QuantaSylva Hash (QSH)Hash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
QuantaSylva Hash (QSH)Hash · symmetric	Full-round core permutation has a one-query invariant-subspace distinguisherngcc.dev hash-24-1	ISCAS2026-09-22
WChainHash · symmetric	Public comment on WChain: an invariant subspace of the word operationsCryptHash forum	Cryptanalysts001 (ISCAS)2026-09-22
WChainHash · symmetric	Structural Weaknesses in 7 NGCC Submitted Hash FunctionsePrint 2026/2152	Yufei Yuan, Ruichen Wu, Shanpeng Wei, Junxu Shen, Jinpeng Liu, Yixin Zhang2026-09-22
ZC-DMCHash · symmetric	Cross-domain distinguisher between ZC-1536-512 and ZC-1536-768ngcc.dev hash-31-1	Tsinghua Hash Lab2026-09-22
ZC-EDMCHash · symmetric	The specified and implemented ZC-EDMC mappings differngcc.dev hash-32-1	Cryptanalysts001, Institute of Software, Chinese Academy of Sciences2026-09-22

Where other teams publish

Source	By	What it covers
ngcc.dev reports	M.-J. Saarinen	A tracker of reported vulnerabilities in all 119 candidates, collected from several teams, with reproduction steps
CryptHash public comment forum	ICCS	Public comments on the hash candidates: analyses by ISCAS and the Tsinghua Hash Lab, and the design teams' replies and errata
NGCC PKC public comment forum	ICCS	Public comments on the public-key candidates, with the design teams' replies and fixes
ngcc-harness issues	GitHub	Reports and reproduction code submitted to the ngcc.dev tracker
ePrint 2026/2152	Y. Yuan, R. Wu, S. Wei, J. Shen, J. Liu, Y. Zhang (ISCAS, UCAS)	Structural weaknesses in seven of the hash candidates, among them MoFang, Neulaser, CHIME and CHAMP
ePrint 2026/1403	S. Abelard, L. Perret, H. Shi	A polynomial-time key recovery on an earlier version of Facto-DSA
champ-cryptanalysis	M. Idrassi	A collision search on CHAMP, with certificates on reduced parameters
facto_dsa_ngcc_round1	MingLLuo	A forgery on Facto-DSA-128 from the public key alone

Cryptanalysis of the hash function submissions

Practical (4)

Theoretical (2)

Minor break (4)

Security proof gap (1)

Practical (9)

Theoretical (3)

Minor break (7)

Security proof gap (1)

Observations (18)

Where other teams publish