Bugs in the code the designers submitted, where the specification itself is sound. A code bug is fixed in the code, so its verdict is always a minor break. PQC-X does not hunt for these; they are the ones met while attacking the designs.
Vulnerabilities (23)
| Verdict | Candidate | Finding | Feasibility | Credit |
|---|---|---|---|---|
| Minor break | AFS-KEX | Forward secrecy fails | Demonstrated | PQC-X* · first public: M.-J. Saarinen*PQC-X adds: static keys suffice for past peers |
| Minor break | Aigis-Enc+ | Implicit rejection not applied | Demonstrated | PQC-X · first public: M.-J. Saarinen |
| Minor break | Amoeba | Re-encryption check skips most bytes | Demonstrated | PQC-X · first public: Jinnuo Li |
| Minor break | Amoeba | Decryption failure oracle in decapsulation | Demonstrated | PQC-X |
| Minor break | CEDRUS+C | Few-time keys reused | Demonstrated | PQC-X · first public: M.-J. Saarinen |
| Minor break | CheetahKEM | Broken implicit rejection mask | Demonstrated | PQC-X · first public: M.-J. Saarinen |
| Minor break | CreTAKE | Session state alone yields the key | Demonstrated | PQC-X, after M.-J. Saarinen |
| Minor break | CS | Unchecked signature padding | Demonstrated | PQC-X · first public: M.-J. Saarinen |
| Minor break | FLIT | Keys and shared secrets are public | Demonstrated | PQC-X |
| Minor break | MORNING-ATLAS | Key recovery from paired mask coefficients | Demonstrated | PQC-X · first public: Xianhui Lu and Yijian Liu |
| Minor break | VDOO | The same key pair for every user | Demonstrated | PQC-X · first public: M.-J. Saarinen |
| Minor break | CEDRUS-α | Few-time secrets aliased | Tested at small scale | PQC-X* · first public: shiyuan*PQC-X adds: full-scheme forgery cost |
| Minor break | CreTAKE | Responder randomness cut to 64 bits | Argued | PQC-X · first public: M.-J. Saarinen |
| Minor break | Loom | Ephemeral key not retired | Argued | PQC-X · first public: M.-J. Saarinen |
| Minor break | MAMBA-Viper | Long-term seed too short | Tested at small scale | PQC-X · first public: M.-J. Saarinen |
| Minor break | NTRE | Truncated key-generation seed | Tested at small scale | PQC-X · first public: M.-J. Saarinen |
| Minor break | Aigis-Sig+ | Challenge sampler drops sign bits | Argued | PQC-X |
| Minor break | CEDRUS-α | Only 128 of the 160 bits are signed | Argued | PQC-X · first public: shiyuan |
| Minor break | COMPASS-SIG | Key-generation seed too short | Argued | PQC-X* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall |
| Minor break | COMPASS-SIG | Signing key too short | Argued | PQC-X |
| Minor break | COMPASS-SIG | Challenge sampler not uniform | Argued | PQC-X |
| Minor break | CTL | Message and shared key too short | Argued | PQC-X · first public: M.-J. Saarinen |
| Minor break | Rhyme | Challenge-guessing forgery | Argued | PQC-X |
Security proof gap (3)
| Verdict | Candidate | Finding | Feasibility | Credit |
|---|---|---|---|---|
| Security proof gap | MORNING-Scabbard | Rounding constant omitted in code | Demonstrated | PQC-X · first public: M.-J. Saarinen |
| Security proof gap | YuanYang.KEM | Error term dropped in code | Demonstrated | PQC-X · first public: Yijian Liu |
| Security proof gap | YuanYang.DSA | Secret-dependent perturbation covariance | Argued | PQC-X* · first public: Kris Kwiatkowski*PQC-X adds: a non-zero signature mean |
Observations (16)
Code or test vectors that disagree with the specification, or code that misbehaves, with no claimed property falling.
90 findings on 52 candidates: 42 by PQC-X and 48 published by other teams, from 6 authors or groups; 35 breaks by the site's rules.
A public finding is cited as its authors published it: the title is theirs and the link leads to their page. Its verdict is PQC-X's, computed by the same rules as for its own findings from what the report states; PQC-X has not reproduced it. 30 public reports that PQC-X reproduced or found independently are listed once, under PQC-X. Other teams' pages last checked on 2026-09-24.
Minor break (35)
Security proof gap (3)
| Verdict | Candidate | Finding | By |
|---|---|---|---|
| Security proof gap | MORNING-Scabbard | Rounding constant omitted in code | PQC-X · first public: M.-J. Saarinen |
| Security proof gap | YuanYang.DSA | Secret-dependent perturbation covariance | PQC-X* · first public: Kris Kwiatkowski*PQC-X adds: a non-zero signature mean |
| Security proof gap | YuanYang.KEM | Error term dropped in code | PQC-X · first public: Yijian Liu |
Observations (52)
No claimed or required property falls, or the report establishes nothing yet; a limit of the placeholder hash is marked "not counted".
Where other teams publish
| Source | By | What it covers |
|---|---|---|
| ngcc.dev reports | M.-J. Saarinen | A tracker of reported vulnerabilities in all 119 candidates, collected from several teams, with reproduction steps |
| CryptHash public comment forum | ICCS | Public comments on the hash candidates: analyses by ISCAS and the Tsinghua Hash Lab, and the design teams' replies and errata |
| NGCC PKC public comment forum | ICCS | Public comments on the public-key candidates, with the design teams' replies and fixes |
| ngcc-harness issues | GitHub | Reports and reproduction code submitted to the ngcc.dev tracker |
| ePrint 2026/2152 | Y. Yuan, R. Wu, S. Wei, J. Shen, J. Liu, Y. Zhang (ISCAS, UCAS) | Structural weaknesses in seven of the hash candidates, among them MoFang, Neulaser, CHIME and CHAMP |
| ePrint 2026/1403 | S. Abelard, L. Perret, H. Shi | A polynomial-time key recovery on an earlier version of Facto-DSA |
| champ-cryptanalysis | M. Idrassi | A collision search on CHAMP, with certificates on reduced parameters |
| facto_dsa_ngcc_round1 | MingLLuo | A forgery on Facto-DSA-128 from the public key alone |