PQC-XXJTLU · cryptanalysis

HomePublic-key schemes › Implementation

Implementation bugs in the public-key submissions

Bugs in the code the designers submitted, where the specification itself is sound. A code bug is fixed in the code, so its verdict is always a minor break. PQC-X does not hunt for these; they are the ones met while attacking the designs.

Cryptanalysis page →

Vulnerabilities (23)

VerdictCandidateFindingFeasibilityCredit
Minor breakAFS-KEXKEX · latticeForward secrecy failsDemonstratedPQC-X* · first public: M.-J. Saarinen*PQC-X adds: static keys suffice for past peers
Minor breakAigis-Enc+KEM · latticeImplicit rejection not appliedDemonstratedPQC-X · first public: M.-J. Saarinen
Minor breakAmoebaKEM · latticeRe-encryption check skips most bytesDemonstratedPQC-X · first public: Jinnuo Li
Minor breakAmoebaKEM · latticeDecryption failure oracle in decapsulationDemonstratedPQC-X
Minor breakCEDRUS+CSignature · hash-basedFew-time keys reusedDemonstratedPQC-X · first public: M.-J. Saarinen
Minor breakCheetahKEMKEM · latticeBroken implicit rejection maskDemonstratedPQC-X · first public: M.-J. Saarinen
Minor breakCreTAKEKEX · latticeSession state alone yields the keyDemonstratedPQC-X, after M.-J. Saarinen
Minor breakCSSignature · latticeUnchecked signature paddingDemonstratedPQC-X · first public: M.-J. Saarinen
Minor breakFLITKEM · latticeKeys and shared secrets are publicDemonstratedPQC-X
Minor breakMORNING-ATLASSignature · latticeKey recovery from paired mask coefficientsDemonstratedPQC-X · first public: Xianhui Lu and Yijian Liu
Minor breakVDOOSignature · multivariateThe same key pair for every userDemonstratedPQC-X · first public: M.-J. Saarinen
Minor breakCEDRUS-αSignature · hash-basedFew-time secrets aliasedTested at small scalePQC-X* · first public: shiyuan*PQC-X adds: full-scheme forgery cost
Minor breakCreTAKEKEX · latticeResponder randomness cut to 64 bitsArguedPQC-X · first public: M.-J. Saarinen
Minor breakLoomKEX · latticeEphemeral key not retiredArguedPQC-X · first public: M.-J. Saarinen
Minor breakMAMBA-ViperKEM · latticeLong-term seed too shortTested at small scalePQC-X · first public: M.-J. Saarinen
Minor breakNTREKEM · latticeTruncated key-generation seedTested at small scalePQC-X · first public: M.-J. Saarinen
Minor breakAigis-Sig+Signature · latticeChallenge sampler drops sign bitsArguedPQC-X
Minor breakCEDRUS-αSignature · hash-basedOnly 128 of the 160 bits are signedArguedPQC-X · first public: shiyuan
Minor breakCOMPASS-SIGSignature · latticeKey-generation seed too shortArguedPQC-X* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall
Minor breakCOMPASS-SIGSignature · latticeSigning key too shortArguedPQC-X
Minor breakCOMPASS-SIGSignature · latticeChallenge sampler not uniformArguedPQC-X
Minor breakCTLKEM · latticeMessage and shared key too shortArguedPQC-X · first public: M.-J. Saarinen
Minor breakRhymeSignature · latticeChallenge-guessing forgeryArguedPQC-X

Security proof gap (3)

VerdictCandidateFindingFeasibilityCredit
Security proof gapMORNING-ScabbardKEM · latticeRounding constant omitted in codeDemonstratedPQC-X · first public: M.-J. Saarinen
Security proof gapYuanYang.KEMKEM · latticeError term dropped in codeDemonstratedPQC-X · first public: Yijian Liu
Security proof gapYuanYang.DSASignature · latticeSecret-dependent perturbation covarianceArguedPQC-X* · first public: Kris Kwiatkowski*PQC-X adds: a non-zero signature mean

Observations (16)

Code or test vectors that disagree with the specification, or code that misbehaves, with no claimed property falling.

CandidateFindingFeasibilityCredit
BW-KEMKEM · latticeRejection signalled by return codeDemonstratedPQC-X
FLITKEM · latticeAVX2 ciphertexts not conformantDemonstratedPQC-X
LoomKEX · latticeThe reference draws the ephemeral secret r from PRF streams the public-key lifting also readsDemonstratedPQC-X
MAMBA-FrostKEM · latticeDecapsulation restores the sign of each secret coefficient with a branch, in every submitted buildDemonstratedPQC-X
PhoenixSignature · hash-basedCode and test vectors disagreeDemonstratedPQC-X
TinsSignature · multivariateVerifier reads a variable it never setsDemonstratedPQC-X
ZENKEM · latticeReference Compress differs from the specified rounding on five residuesDemonstratedPQC-X
AFS-KEXKEX · latticeThe frozen composite key exposes about 26 decryption failures of AFS-KEX-C128 within the call's query budgetArguedPQC-X, after M.-J. Saarinen
Aigis-Enc+KEM · latticeRejection secret read out of boundsArguedPQC-X · first public: M.-J. Saarinen
CEDRUS+CSignature · hash-basedOff-by-one against the specificationArguedPQC-X
CEDRUS-αSignature · hash-basedPRF differs from the specificationArguedPQC-X* · first public: shiyuan*PQC-X adds: all three UCAS designs affected
DARTSSignature · latticeVerifier norm check never failsArguedPQC-X
FlexTreeSignature · hash-basedDigest bits left uncheckedArguedMikhail Kudinov · reproduced by PQC-X
FlexTreeSignature · hash-basedOff-by-one against the specificationArguedMikhail Kudinov · reproduced by PQC-X
NTREKEM · latticeMessage re-encryption timing branchArguedPQC-X
WeaverKEMKEM · latticePRF substream reuseArguedPQC-X · first public: M.-J. Saarinen

90 findings on 52 candidates: 42 by PQC-X and 48 published by other teams, from 6 authors or groups; 35 breaks by the site's rules.

A public finding is cited as its authors published it: the title is theirs and the link leads to their page. Its verdict is PQC-X's, computed by the same rules as for its own findings from what the report states; PQC-X has not reproduced it. 30 public reports that PQC-X reproduced or found independently are listed once, under PQC-X. Other teams' pages last checked on 2026-09-24.

Minor break (35)

VerdictCandidateFindingBy
Minor breakAFS-KEXKEX · latticeForward secrecy failsPQC-X* · first public: M.-J. Saarinen*PQC-X adds: static keys suffice for past peers
Minor breakAigis-Enc+KEM · latticeImplicit rejection not appliedPQC-X · first public: M.-J. Saarinen
Minor breakAigis-Sig+Signature · latticeChallenge sampler drops sign bitsPQC-X
Minor breakAigis-Sig+Signature · latticeTrivial signature malleability violates SUF-CMAngcc.dev sign-01-1Markku-Juhani O. Saarinen2026-09-21
Minor breakAmoebaKEM · latticeRe-encryption check skips most bytesPQC-X · first public: Jinnuo Li
Minor breakAmoebaKEM · latticeDecryption failure oracle in decapsulationPQC-X
Minor breakCEDRUS+CSignature · hash-basedFew-time keys reusedPQC-X · first public: M.-J. Saarinen
Minor breakCEDRUS-αSignature · hash-basedFew-time secrets aliasedPQC-X* · first public: shiyuan*PQC-X adds: full-scheme forgery cost
Minor breakCEDRUS-αSignature · hash-basedOnly 128 of the 160 bits are signedPQC-X · first public: shiyuan
Minor breakCheetahKEMKEM · latticeBroken implicit rejection maskPQC-X · first public: M.-J. Saarinen
Minor breakCOMPASS-SIGSignature · latticeKey-generation seed too shortPQC-X* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall
Minor breakCOMPASS-SIGSignature · latticeSigning key too shortPQC-X
Minor breakCOMPASS-SIGSignature · latticeChallenge sampler not uniformPQC-X
Minor breakCreTAKEKEX · latticeResponder randomness cut to 64 bitsPQC-X · first public: M.-J. Saarinen
Minor breakCreTAKEKEX · latticeSession state alone yields the keyPQC-X, after M.-J. Saarinen
Minor breakCSSignature · latticeUnchecked signature paddingPQC-X · first public: M.-J. Saarinen
Minor breakCTLKEM · latticeMessage and shared key too shortPQC-X · first public: M.-J. Saarinen
Minor breakFLITKEM · latticeKeys and shared secrets are publicPQC-X
Minor breakGalasSignature · symmetric (MPC/VOLE-in-the-head)Publicly reproducible signing keysngcc.dev sign-12-1Markku-Juhani O. Saarinen2026-09-21
Minor breakHEP-QCKEM · codePublicly reproducible secret keysngcc.dev kem-17-1Markku-Juhani O. Saarinen2026-09-21
Minor breakHEP-QCKEM · codeFirst encapsulation in each process is publicly reproduciblengcc.dev kem-17-3Markku-Juhani O. Saarinen2026-09-21
Minor breakLoomKEX · latticeEphemeral key not retiredPQC-X · first public: M.-J. Saarinen
Minor breakLoongKEMKEM · latticePartial rejection mask leaks the candidate shared secretngcc.dev kem-18-1Markku-Juhani O. Saarinen2026-09-21
Minor breakMAMBA-ViperKEM · latticeLong-term seed too shortPQC-X · first public: M.-J. Saarinen
Minor breakMORNING-ATLASSignature · latticeKey recovery from paired mask coefficientsPQC-X · first public: Xianhui Lu and Yijian Liu
Minor breakMORNING-ATLASSignature · latticeTrivial hint-padding malleability violates SUF-CMAngcc.dev sign-15-2Markku-Juhani O. Saarinen2026-09-21
Minor breakNIIKEKEX · isogenyNIIKE-lv512 key generation cycles between two hard-coded secret keysngcc.dev kex-08-2Markku-Juhani O. Saarinen2026-09-23
Minor breakNTREKEM · latticeTruncated key-generation seedPQC-X · first public: M.-J. Saarinen
Minor breakRhymeSignature · latticeChallenge-guessing forgeryPQC-X
Minor breakSQIsign2D2Signature · isogenyVerifier verdict is decided by stale stack contentsngcc.dev sign-25-1Markku-Juhani O. Saarinen2026-09-21
Minor breakUVWSignature · codeEvery signature is acceptedngcc.dev sign-32-1Markku-Juhani O. Saarinen2026-09-21
Minor breakUVW-KEMKEM · codeUVW-512 derives its encryption pair from only 256 bitsngcc.dev kem-38-1Markku-Juhani O. Saarinen2026-09-21
Minor breakVDOOSignature · multivariateThe same key pair for every userPQC-X · first public: M.-J. Saarinen
Minor breakVDOOSignature · multivariateA 256-bit implementation prehash limits forgery security to 128 bitsngcc.dev sign-33-2Markku-Juhani O. Saarinen2026-09-21
Minor breakVDOOSignature · multivariateSigning reuses a publicly predictable randomness streamngcc.dev sign-33-4Markku-Juhani O. Saarinen2026-09-21

Security proof gap (3)

VerdictCandidateFindingBy
Security proof gapMORNING-ScabbardKEM · latticeRounding constant omitted in codePQC-X · first public: M.-J. Saarinen
Security proof gapYuanYang.DSASignature · latticeSecret-dependent perturbation covariancePQC-X* · first public: Kris Kwiatkowski*PQC-X adds: a non-zero signature mean
Security proof gapYuanYang.KEMKEM · latticeError term dropped in codePQC-X · first public: Yijian Liu

Observations (52)

No claimed or required property falls, or the report establishes nothing yet; a limit of the placeholder hash is marked "not counted".

CandidateFindingBy
AFS-KEXKEX · latticeThe frozen composite key exposes about 26 decryption failures of AFS-KEX-C128 within the call's query budgetPQC-X, after M.-J. Saarinen
AFS-KEXKEX · latticeSecret-derived decryption coefficients take a sign branchngcc.dev kex-02-2Markku-Juhani O. Saarinen2026-09-23
Aigis-Enc+KEM · latticeRejection secret read out of boundsPQC-X · first public: M.-J. Saarinen
Aigis-Sig+Signature · latticeMalformed hint counts cause an attacker-controlled stack writengcc.dev sign-01-2Markku-Juhani O. Saarinen2026-09-21
Aigis-Sig+Signature · latticeSignature API ignores declared key-buffer lengthsngcc.dev sign-01-3Askus Operator (Luna High), with human review by Askus Li2026-09-23
Aigis-Sig+Signature · latticeHonest signing writes one polynomial past the mask vectorngcc.dev sign-01-4Askus Operator (Luna High), with human review by Askus Li2026-09-23
AmoebaKEM · latticeSecret-derived ECC decoding indexes a syndrome tablengcc.dev kem-02-2Markku-Juhani O. Saarinen2026-09-23
BAG-LoongKEM · codeSecret-dependent pivoting in the Gabidulin decoderngcc.dev kem-03-1Markku-Juhani O. Saarinen2026-09-23
BAG-PigletKEM · codeSecret-dependent pivoting in the Gabidulin decoderngcc.dev kem-04-1Markku-Juhani O. Saarinen2026-09-23
BRAKEM · codeA malformed secret key drives the BRA decoder out of boundsngcc.dev kem-06-1Dariia Porechna ( @dariolina )2026-09-22
BRAKEM · codeReference field multiplication touches one limb past its outputngcc.dev kem-06-2Further extension to Dariia Porechna's analysis2026-09-22
BRAKEM · codeSecret-derived decoder pivots select memory addressesngcc.dev kem-06-3Markku-Juhani O. Saarinen2026-09-23
BRQCKEM · codeSecret-derived decoder pivots select memory addressesngcc.dev kem-07-1Markku-Juhani O. Saarinen2026-09-23
BW-KEMKEM · latticeRejection signalled by return codePQC-X
BW-KEMKEM · latticeC128 decapsulation branches on decrypted coefficientsngcc.dev kem-08-1Markku-Juhani O. Saarinen2026-09-23
C-Multi-UR-AGKEM · codeMalformed ciphertexts crash the reference decapsulatorngcc.dev kem-10-1Markku-Juhani O. Saarinen2026-09-23
C-Multi-UR-AGKEM · codeSecret-derived decoder pivots select memory addressesngcc.dev kem-10-2Markku-Juhani O. Saarinen2026-09-23
CEDRUS+CSignature · hash-basedOff-by-one against the specificationPQC-X
CEDRUS-αSignature · hash-basedPRF differs from the specificationPQC-X* · first public: shiyuan*PQC-X adds: all three UCAS designs affected
DARTSSignature · latticeVerifier norm check never failsPQC-X
DTRUKEM · latticeCaller-declared ciphertext length overflows a decapsulation stack bufferngcc.dev kem-14-1Markku-Juhani O. Saarinen2026-09-23
FlexTreeSignature · hash-basedDigest bits left uncheckedMikhail Kudinov · reproduced by PQC-X
FlexTreeSignature · hash-basedOff-by-one against the specificationMikhail Kudinov · reproduced by PQC-X
FLITKEM · latticeAVX2 ciphertexts not conformantPQC-X
HEP-QCKEM · codeSecret permutation and mixing matrix drive memory and control flowngcc.dev kem-17-5Markku-Juhani O. Saarinen2026-09-23
LoomKEX · latticeThe reference draws the ephemeral secret r from PRF streams the public-key lifting also readsPQC-X
MAMBA-FrostKEM · latticeDecapsulation restores the sign of each secret coefficient with a branch, in every submitted buildPQC-X
MitoKEM · codeMito-E discards every erasure before Reed–Solomon decodingngcc.dev kem-23-1Markku-Juhani O. Saarinen2026-09-21
MORNING-ATLASSignature · latticeReturned-length error causes an out-of-bounds heap disclosurengcc.dev sign-15-1Markku-Juhani O. Saarinen2026-09-21
MORNING-ATLASSignature · latticeThe ATLAS-192 challenge space is below 192 bitsngcc.dev sign-15-3Markku-Juhani O. Saarinen2026-09-21
NEV-AKEKEX · latticeBoth party identities are hard-wired to zerongcc.dev kex-07-1Markku-Juhani O. Saarinen2026-09-21
NTREKEM · latticeMessage re-encryption timing branchPQC-X
OrigamiSignature · multivariateVariable-time hidden-zone linear solvingngcc.dev sign-18-3Markku-Juhani O. Saarinen2026-09-23
OrigamiSignature · multivariateSigning indexes field tables and signature state with private valuesngcc.dev sign-18-4Markku-Juhani O. Saarinen2026-09-23
PhoenixSignature · hash-basedCode and test vectors disagreePQC-X
QCTMKEM · codeDebug path retains the secret error vectorngcc.dev kem-32-1Markku-Juhani O. Saarinen2026-09-21
QIMEN-PIKEKEM · isogenyInvalid ciphertexts trigger an assertion during decapsulationngcc.dev kem-31-1Markku-Juhani O. Saarinen2026-09-23
QUBEKEM · codeDecapsulation re-expands the private seed with a variable-length samplerngcc.dev kem-33-1Markku-Juhani O. Saarinen2026-09-23
QUBEKEM · codeDecryption multiplication traverses secret support positionsngcc.dev kem-33-2Markku-Juhani O. Saarinen2026-09-23
SQIsignTriangleSignature · isogenyAn all-zero signature aborts the verifier processngcc.dev sign-27-1Markku-Juhani O. Saarinen2026-09-23
TinsSignature · multivariateVerifier reads a variable it never setsPQC-X
TriQ-KEMKEM · codeDecapsulation re-expands its private support with variable workngcc.dev kem-37-1Markku-Juhani O. Saarinen2026-09-23
TriQ-KEXKEX · codeDecapsulation re-expands its secret key with a variable-length samplerngcc.dev kex-09-1Markku-Juhani O. Saarinen2026-09-23
TSUOVSignature · multivariateSecret-dependent echelon pivots during signingngcc.dev sign-31-2Markku-Juhani O. Saarinen2026-09-23
UVWSignature · codeAn all-zero signature crashes two verifier instancesngcc.dev sign-32-2Markku-Juhani O. Saarinen2026-09-21
UVW-KEMKEM · codeUVW exposes a stable list-decoding failure oraclengcc.dev kem-38-2Markku-Juhani O. Saarinen2026-09-21
VDOOSignature · multivariateSigning branches directly on private central-map coefficientsngcc.dev sign-33-5Markku-Juhani O. Saarinen2026-09-23
WeaverKEMKEM · latticePRF substream reusePQC-X · first public: M.-J. Saarinen
WeaverKEMKEM · latticeWeaverKEM-256 omits its high-layer BCH decoderngcc.dev kem-39-2Yijian Liu (with AI assistance)2026-09-24
YuanYang.DSASignature · latticeNon-injective public-key packing creates key aliasesngcc.dev sign-34-2Kris Kwiatkowski2026-09-22
YuanYang.KEMKEM · latticeDecapsulation addresses a private array with a secret-derived indexngcc.dev kem-40-2Markku-Juhani O. Saarinen2026-09-23
ZENKEM · latticeReference Compress differs from the specified rounding on five residuesPQC-X

Where other teams publish

SourceByWhat it covers
ngcc.dev reportsM.-J. SaarinenA tracker of reported vulnerabilities in all 119 candidates, collected from several teams, with reproduction steps
CryptHash public comment forumICCSPublic comments on the hash candidates: analyses by ISCAS and the Tsinghua Hash Lab, and the design teams' replies and errata
NGCC PKC public comment forumICCSPublic comments on the public-key candidates, with the design teams' replies and fixes
ngcc-harness issuesGitHubReports and reproduction code submitted to the ngcc.dev tracker
ePrint 2026/2152Y. Yuan, R. Wu, S. Wei, J. Shen, J. Liu, Y. Zhang (ISCAS, UCAS)Structural weaknesses in seven of the hash candidates, among them MoFang, Neulaser, CHIME and CHAMP
ePrint 2026/1403S. Abelard, L. Perret, H. ShiA polynomial-time key recovery on an earlier version of Facto-DSA
champ-cryptanalysisM. IdrassiA collision search on CHAMP, with certificates on reduced parameters
facto_dsa_ngcc_round1MingLLuoA forgery on Facto-DSA-128 from the public key alone