CEDRUS-α · PQC-X

Implementation

Bugs in the submitted code; the specification is sound on these points.

Minor break The FORC chain address is written into one byte: only 256 chain secrets per instance
Minor break For n = 20 the one-time encoder reads only 128 of the 160 bits
Holds The code's PRF differs from the specified one

cedrus-alpha-i1

The FORC chain address is written into one byte: only 256 chain secrets per instance

Minor break · Tested at small scale · Cause: code

Property: existential unforgeability of the submitted code

Cost against claim: full forgery after ≈2⁶⁷ to 2⁷³ signatures, inside the call's 2⁸⁰ budget

The global FORC chain index, up to k·2^a, is passed to an address setter that writes a single byte. Indices equal modulo 256 share their secrets, so each instance has 256 distinct chain secrets instead of k·2^a.

Parameter set	Claim	Attack cost	Verdict
all eight CEDRUS-α sets	160 to 512 classical	≈2⁶⁷ to 2⁷³ signatures	Minor break

Evidence

A fresh-digest FORC signature accepted by the shipped verification routine, reproduced three times. The full-scheme cost accounts for the signer-secret randomiser, which spreads signatures over instances.

Cause in the submitted code; the specification is not affected.

Limits

The full-scheme forgery needs more than the 2⁶⁴ signatures a key must support, but fewer than the 2⁸⁰ the evaluation allows an attacker.

What PQC-X adds

The cost of the full-scheme forgery, about 2⁶⁷ to 2⁷³ signatures, which places it inside the budget the call gives an attacker; the first report stopped at the aliasing of the secrets.

Credit

First public report: shiyuan (PKC forum, also ngcc.dev sign-04-2, 2026-09-22). Found independently by PQC-X.

cedrus-alpha-i2

For n = 20 the one-time encoder reads only 128 of the 160 bits

Minor break · Argued · Cause: code

Property: second-preimage resistance of the one-time layer

Cost against claim: 2¹²⁸ classical and 2⁶⁴ quantum, against 160 and the 80-bit quantum floor

The encoder's word count is n/8, which is 2 for n = 20 bytes, so it loads 128 of the 160 bits of each root it signs; the last 4 bytes are neither signed nor checked.

Parameter set	Claim	Attack cost	Verdict
CEDRUS-α-160s, -160f	160 classical, 80 quantum	2¹²⁸ classical; 2⁶⁴ quantum	Minor break

Evidence

Cause in the submitted code; the specification is not affected.

Credit

First public report: shiyuan (PKC forum, also ngcc.dev sign-04-1, 2026-09-22). Found independently by PQC-X.

cedrus-alpha-i3

The code's PRF differs from the specified one

Holds · Argued · Cause: code

Property: conformance

Cost against claim: an implementation written from the specification reproduces no official key or signature

The specified PRF pads PK.seed and uses the compressed address; the code hashes SK.seed with the full 32-byte address and no PK.seed. Mild on its own, since SK.seed is random per key.

Parameter set	Claim	Attack cost	Verdict
all eight CEDRUS-α sets	specified PRF	none	Holds

Evidence

Cause in the submitted code; the specification is not affected.

What PQC-X adds

The address and padding divergence also affects CEDRUS+C and FlexTree, which keep PK.seed but still use the full address: no UCAS design can be reimplemented from its specification.

Credit

First public report: shiyuan (PKC forum, also ngcc.dev sign-04-3, 2026-09-22). Found independently by PQC-X.