Public-key schemes · cryptanalysis

Attacks whose cause lies in the specification of a candidate, rated by what they actually cost against what the designers claim and what the call requires.

Implementation vulnerabilities page →

Practical: The construction itself is broken, at a classical cost of at most 2⁸⁰ in the unit of the claim.
Theoretical: The construction itself is broken, below the claim, but the attack is out of reach.
Minor break: A claim falls, but the designers fix it locally (a size, a missing check, a code bug), or only a secondary property falls.
Security proof gap: The security argument does not establish the claim, and no attack is known.

Feasibility. Demonstrated: run on the real parameters. Tested at small scale: run on a smaller instance, the real cost extrapolated. Argued: from an argument or an exact computation.

PQC-XAll findings

21 breaks: 2 practical, 0 theoretical, 19 minor; 2 demonstrated. 4 security proof gaps.

Practical (2)

Verdict	Candidate	Finding	Feasibility	Credit
Practical	Polar-KEMKEM · lattice	No trapdoor in specification	Demonstrated	PQC-X · first public: M.-J. Saarinen
Practical	Facto-DSASignature · multivariate	Key recovery	Tested at small scale	PQC-X · first public: Kris Kwiatkowski

Minor break (19)

Verdict	Candidate	Finding	Feasibility	Credit
Minor break	OAEP-NTRUKEM · lattice	Malleable ciphertext byte encoding	Demonstrated	PQC-X
Minor break	CEDRUS+CSignature · hash-based	Forgery against a verifier that follows the specification	Argued	PQC-X, after Mikhail Kudinov
Minor break	FlexTreeSignature · hash-based	Forgery against a verifier that follows the specification	Argued	Mikhail Kudinov · reproduced by PQC-X
Minor break	BiTSignature · lattice	Message digest too short	Tested at small scale	PQC-X · first public: M.-J. Saarinen
Minor break	COMPASS-KEMKEM · lattice	Seed, message and key too short	Tested at small scale	PQC-X^* · first public: M.-J. Saarinen*PQC-X adds: message recovery, quantum shortfall
Minor break	MAMBA-ViperKEM · lattice	FO coin too short	Tested at small scale	PQC-X
Minor break	Aigis-Sig+Signature · lattice	Message digest too short	Argued	PQC-X
Minor break	COMPASS-SIGSignature · lattice	Message digest too short	Argued	PQC-X^* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall
Minor break	CTLKEM · lattice	Key-generation seed too short	Argued	PQC-X · first public: M.-J. Saarinen
Minor break	DARTSSignature · lattice	Message digest too short	Argued	PQC-X^* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall
Minor break	Facto-DSASignature · multivariate	Message digest too short	Argued	PQC-X
Minor break	LoreKEM · lattice	Key seed too short	Argued	PQC-X
Minor break	LoreKEM · lattice	Shared key too short	Argued	PQC-X
Minor break	MORNING-ATLASSignature · lattice	Undersized challenge space	Argued	PQC-X
Minor break	MORNING-ATLASSignature · lattice	Message digest too short	Argued	PQC-X
Minor break	MORNING-ATLASSignature · lattice	Undersized master seed	Argued	PQC-X
Minor break	RhymeSignature · lattice	Key recovery below level	Argued	PQC-X · first public: M.-J. Saarinen
Minor break	RhymeSignature · lattice	Digest collision forgery	Argued	PQC-X · first public: M.-J. Saarinen
Minor break	TinsSignature · multivariate	Quantum security below the call's floor	Argued	PQC-X

Security proof gap (4)

Verdict	Candidate	Finding	Feasibility	Credit
Security proof gap	NEVKEM · lattice	C2 failure rate underestimated	Demonstrated	PQC-X
Security proof gap	AmoebaKEM · lattice	Decryption failure rate understated	Argued	PQC-X · first public: Yijian Liu
Security proof gap	COMPASS-KEMKEM · lattice	Decryption-failure rate understated	Argued	PQC-X
Security proof gap	DOVESignature · multivariate	Proof analyses a different algorithm	Argued	PQC-X · first public: Dariia Porechna

74 findings on 40 candidates: 44 by PQC-X and 30 published by other teams, from 19 authors or groups; 32 breaks by the site's rules.

A public finding is cited as its authors published it: the title is theirs and the link leads to their page. Its verdict is PQC-X's, computed by the same rules as for its own findings from what the report states; PQC-X has not reproduced it. 11 public reports that PQC-X reproduced or found independently are listed once, under PQC-X. Other teams' pages last checked on 2026-09-25.

Practical (6)

Verdict	Candidate	Finding	By
Practical	CheetahKEMKEM · lattice	A degree-128 quotient defeats the full-dimension MLWE estimatesngcc.dev kem-09-2	XuHaomeng2026-09-22
Practical	Facto-DSASignature · multivariate	Key recovery	PQC-X · first public: Kris Kwiatkowski
Practical	Facto-DSASignature · multivariate	The public key yields a universal signing trapdoorngcc.dev sign-10-2	MingLLuo2026-09-22
Practical	OrigamiSignature · multivariate	Public variable permutation permits signature forgeryngcc.dev sign-18-5	Pierre Pébereau2026-09-24
Practical	Polar-KEMKEM · lattice	No trapdoor in specification	PQC-X · first public: M.-J. Saarinen
Practical	TinsSignature · multivariate	One signature reveals the complete signing witnessngcc.dev sign-29-1	Tianyuan Xie2026-09-22

Theoretical (2)

Verdict	Candidate	Finding	By
Theoretical	CSSignature · lattice	Verifier challenge-sign blindness enables universal forgeryngcc.dev sign-07-2	Kris Kwiatkowski2026-09-21
Theoretical	HEP-QCKEM · code	Public column multiplicities break the EPC-P assumptionngcc.dev kem-17-4	Tianyuan Xie2026-09-22

Minor break (24)

Verdict	Candidate	Finding	By
Minor break	Aigis-Sig+Signature · lattice	Message digest too short	PQC-X
Minor break	BiTSignature · lattice	Message digest too short	PQC-X · first public: M.-J. Saarinen
Minor break	CEDRUS+CSignature · hash-based	Forgery against a verifier that follows the specification	PQC-X, after Mikhail Kudinov
Minor break	COMPASS-KEMKEM · lattice	Seed, message and key too short	PQC-X^* · first public: M.-J. Saarinen*PQC-X adds: message recovery, quantum shortfall
Minor break	COMPASS-SIGSignature · lattice	Message digest too short	PQC-X^* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall
Minor break	CTLKEM · lattice	Key-generation seed too short	PQC-X · first public: M.-J. Saarinen
Minor break	DARTSSignature · lattice	Message digest too short	PQC-X^* · first public: M.-J. Saarinen*PQC-X adds: the quantum shortfall
Minor break	Facto-DSASignature · multivariate	Message digest too short	PQC-X
Minor break	FlexTreeSignature · hash-based	Forgery against a verifier that follows the specification	Mikhail Kudinov · reproduced by PQC-X
Minor break	HEP-QCKEM · code	HEP-QC-7 has at most 256 bits of key-generation supportngcc.dev kem-17-2	Markku-Juhani O. Saarinen2026-09-21
Minor break	LoreKEM · lattice	Key seed too short	PQC-X
Minor break	LoreKEM · lattice	Shared key too short	PQC-X
Minor break	MAMBA-ViperKEM · lattice	FO coin too short	PQC-X
Minor break	MORNING-ATLASSignature · lattice	Undersized challenge space	PQC-X
Minor break	MORNING-ATLASSignature · lattice	Message digest too short	PQC-X
Minor break	MORNING-ATLASSignature · lattice	Undersized master seed	PQC-X
Minor break	NIIKEKEX · isogeny	The raw shared j-invariant is distinguishable from a uniform keyngcc.dev kex-08-1	Markku-Juhani O. Saarinen2026-09-23
Minor break	OAEP-NTRUKEM · lattice	Malleable ciphertext byte encoding	PQC-X
Minor break	OrigamiSignature · multivariate	A fixed 512-bit message prehash caps forgery security at 256 bitsngcc.dev sign-18-1	Markku-Juhani O. Saarinen2026-09-21
Minor break	OrigamiSignature · multivariate	Signatures expose the hidden-algebra constraint subspacengcc.dev sign-18-2	Peigen Li2026-09-22
Minor break	RhymeSignature · lattice	Key recovery below level	PQC-X · first public: M.-J. Saarinen
Minor break	RhymeSignature · lattice	Digest collision forgery	PQC-X · first public: M.-J. Saarinen
Minor break	TinsSignature · multivariate	Quantum security below the call's floor	PQC-X
Minor break	TSUOVSignature · multivariate	A 512-bit prehash caps forgery security at 256 bitsngcc.dev sign-31-1	Markku-Juhani O. Saarinen2026-09-21

Security proof gap (8)

Verdict	Candidate	Finding	By
Security proof gap	AmoebaKEM · lattice	Decryption failure rate understated	PQC-X · first public: Yijian Liu
Security proof gap	CheetahKEMKEM · lattice	Cheetah's decryption-failure analysis omits public-key roundingngcc.dev kem-09-3	Yijian Liu (with AI assistance)2026-09-24
Security proof gap	COMPASS-KEMKEM · lattice	Decryption-failure rate understated	PQC-X
Security proof gap	DOVESignature · multivariate	Proof analyses a different algorithm	PQC-X · first public: Dariia Porechna
Security proof gap	NEVKEM · lattice	C2 failure rate underestimated	PQC-X
Security proof gap	OctarineSignature · lattice	The stated hash requirement is too weak for the EUF-CMA targetngcc.dev sign-16-1	Markku-Juhani O. Saarinen2026-09-23
Security proof gap	OctarineSignature · lattice	Polynomial solutions of the relaxed Octarine-512 SIS estimatesngcc.dev sign-16-2	Mounir IDRASSI2026-09-23
Security proof gap	VDOOSignature · multivariate	The VDOO-256 and -512 proof bound contains a 128-bit salt termngcc.dev sign-33-3	Markku-Juhani O. Saarinen2026-09-21

Observations (32)

No claimed or required property falls, or the report establishes nothing yet; a limit of the placeholder hash is marked "not counted".

Candidate	Finding	By
BW-KEMKEM · lattice	Failure rate averaged over keys	PQC-X
COMPASS-KEMKEM · lattice	COMPASS-KEM-384 sits at or below 384 bits in the dual and MATZOV cost models	PQC-X
CreTAKEKEX · lattice	BiT-512's digest collision does not transfer into CreTAKE: every signer adds at least 512 fresh bits to what it signs	PQC-X
CSSignature · lattice	CS-512 sits at its level: primal 7 bits above, contested dual-hybrid 10 to 25 bits below	PQC-X
CSSignature · lattice	The one-bit approximation-loss bound is proven for 2⁶⁴ signatures, not the call's 2⁸⁰	PQC-X
CSSignature · lattice	Compressed signatures may leak the CS-128 signing keyngcc.dev sign-07-3	Yijian Liu (on behalf of Xianhui Lu; with AI assistance)2026-09-24
CTLKEM · lattice	Decryption failures are 51 to 246 bits more likely than claimed	PQC-X
DKEMKEM · lattice	DKEM (kem-13): rejection key does not bind c1, causing HON-BIND-K-CT failure and a rejection distinguisherngcc-harness issue 16	zhengjieyu2026-09-25
DOVESignature · multivariate	DOVE-128 meets its level with no margin	PQC-X
DOVESignature · multivariate	DOVE (sign-09): unsalted SM3 target gives EU-CMA forgery in O(2^128) for DOVE-256 and DOVE-512 not countedngcc-harness issue 9	Dariia Porechna2026-09-22
Facto-DSASignature · multivariate	A polynomial-time key recovery attack on Facto-DSAePrint 2026/1403	Simon Abelard, Ludovic Perret, Hao Shi2026-07-09
FlexTreeSignature · hash-based	The subset counter re-rolls subsets on a fixed few-time instance	Mikhail Kudinov · reproduced by PQC-X^**PQC-X adds: the correct budget, no level falls
FlexTreeSignature · hash-based	Unread padding makes signatures malleable	PQC-X · first public: Mikhail Kudinov
FlexTreeSignature · hash-based	The specified PORS tree reuses leaf hash addresses	Mikhail Kudinov · reproduced by PQC-X
FlexTreeSignature · hash-based	SM3's 256-bit state caps the 384- and 512-bit sets not counted	Mikhail Kudinov
FlexTreeSignature · hash-based	Withdrawn — SM3 evaluation-mode length extension not countedngcc.dev sign-11-2	Mikhail Kudinov2026-09-22
FLITKEM · lattice	Failure rate above the claim	PQC-X
FLITKEM · lattice	Below 128 in core-SVP only	PQC-X
LoomKEX · lattice	The specified decryption-failure rate causes honest-session abortsngcc.dev kex-05-1	Markku-Juhani O. Saarinen2026-09-21
LoreKEM · lattice	Lore-512's reducible ring admits smaller quotient attacksngcc.dev kem-19-1	Xu Haomeng and collaborators2026-09-23
MAMBA-FrostKEM · lattice	Every Frost profile clears its level in the MATZOV model only; in core-SVP all five are below it	PQC-X
MithrilKEM · lattice	Reversed decryption offset invalidates the failure estimatengcc.dev kem-22-1	Samuel J. G. G.2026-09-23
NEVKEM · lattice	Message-dependent decapsulation timing	PQC-X
OAEP-NTRUKEM · lattice	Honest ciphertexts are distinguishable from uniform byte strings	PQC-X
PhoenixSignature · hash-based	Security just below the category at 2⁶⁴ signatures	PQC-X
SQIsign2D-push1/2Signature · isogeny	Prime sizing assumes a superseded square-root isogeny costngcc.dev sign-26-1	Yintong Luo2026-09-23
SQIsign2D2Signature · isogeny	Isogeny prime sizing relies on the former square-root attack costngcc.dev sign-25-2	Further extension to Yintong Luo's analysis ; underlying algorithm by Benjamin Wesolowski2026-09-23
SQIsignTriangleSignature · isogeny	Triangle prime sizing relies on the former square-root attack costngcc.dev sign-27-2	Yintong Luo ; underlying algorithm by Benjamin Wesolowski2026-09-23
TRIKEKEM · code	The specified TRIKE decoder rejects every tested honest ciphertextngcc.dev kem-36-1	Markku-Juhani O. Saarinen2026-09-21
VDOOSignature · multivariate	Whether VDOO-512 meets its level depends on the linear-algebra constant	PQC-X
VDOOSignature · multivariate	Public comment on VDOO: the level-5 set estimated at 379 bitsPKC forum	Peigen Li2026-09-22
YuanYang.KEMKEM · lattice	Failure rate underestimated	PQC-X

Not yet classified (2)

Candidate	Finding	By
DKEMKEM · lattice	DKEM's rejection key does not bind the full ciphertextngcc.dev kem-13-1	zhengjieyu2026-09-25
DKEMKEM · lattice	Malicious public key defeats DKEM's contributory key derivationngcc.dev kem-13-2	Markku-Juhani O. Saarinen2026-09-25

Where other teams publish

Source	By	What it covers
ngcc.dev reports	M.-J. Saarinen	A tracker of reported vulnerabilities in all 119 candidates, collected from several teams, with reproduction steps
CryptHash public comment forum	ICCS	Public comments on the hash candidates: analyses by ISCAS and the Tsinghua Hash Lab, and the design teams' replies and errata
NGCC PKC public comment forum	ICCS	Public comments on the public-key candidates, with the design teams' replies and fixes
ngcc-harness issues	GitHub	Reports and reproduction code submitted to the ngcc.dev tracker
ePrint 2026/2152	Y. Yuan, R. Wu, S. Wei, J. Shen, J. Liu, Y. Zhang (ISCAS, UCAS)	Structural weaknesses in seven of the hash candidates, among them MoFang, Neulaser, CHIME and CHAMP
ePrint 2026/1403	S. Abelard, L. Perret, H. Shi	A polynomial-time key recovery on an earlier version of Facto-DSA
champ-cryptanalysis	M. Idrassi	A collision search on CHAMP, with certificates on reduced parameters
facto_dsa_ngcc_round1	MingLLuo	A forgery on Facto-DSA-128 from the public key alone

Cryptanalysis of the public-key submissions