CEDRUS+C · PQC-X

Design

Minor break The specified verifier omits the one-time signature's encoding check

cedrus-plus-c-1

The specified verifier omits the one-time signature's encoding check

Minor break · Argued · Cause: specification text

Property: existential unforgeability, for verifiers that follow the specification

Cost against claim: forgery ≈2³⁵ to 2⁷⁹ on the 160- and 256-bit sets, for a verifier that follows the specification

Scope: Verifiers written from the specification. The submitted code performs the check and is not affected.

The one-time layer (WOTS+C) is secure only if the digit vector lies in its constant-sum set, which no valid codeword can dominate. The specified signer enforces that membership; the specified verifier (Algorithm 6, and the abstract verifier of Construction 1 that the security reduction is about) recomputes the digits and compares without it. A verifier that follows the text therefore accepts a checksum-free Winternitz signature: from one genuine signature, a forger grinds a message whose digits dominate the revealed ones and advances every chain.

Parameter set	Claim	Attack cost	Verdict
CEDRUS+C-160s	160 classical	≈2^35.4	Minor break
CEDRUS+C-160f	160 classical	≈2^48.9	Minor break
CEDRUS+C-256s	256 classical	≈2^57.5	Minor break
CEDRUS+C-256f	256 classical	≈2^78.6	Minor break
CEDRUS+C-384f	384 classical	≈2^100.4	Minor break
CEDRUS+C-384s	384 classical	≈2^115.9	Minor break
CEDRUS+C-512s	512 classical	≈2^133.4	Minor break
CEDRUS+C-512f	512 classical	≈2^134.7	Minor break

What causes it

Algorithm 5 (signing) loops until the leading bits are zero and the digits have the required sum; Algorithm 6 (verification) and Construction 1 recompute the digits and go straight to the chains. The forgery costs 1/∏(w_i − b_i)/w_i hash evaluations per targeted key, and grafting at the top hypertree layer makes it universal.

Evidence

Argued from the specification text; the submitted code (wots.c) rejects any digit vector with the wrong sum. The cost model matches a 20-million-sample Monte Carlo to 0.2%. The forgery has not been run.

Cause in the specification, traced to the specification text.

Limits

Only an implementation written from the specification is forgeable. The fix is to add the signer's membership test to the verifier.

Credit

Found by PQC-X, extending an observation by Mikhail Kudinov (ngcc.dev sign-11-3, 2026-09-22): the same omission in the FlexTree specification.

Implementation

Bugs in the submitted code; the specification is sound on these points.

Minor break The reference code pins the few-time instance to 4 to 128 keys
Holds CEDRUS+C-512s accepts the ceiling of the specified digit sum

cedrus-plus-c-i1

The reference code pins the few-time instance to 4 to 128 keys

Minor break · Demonstrated · Cause: code

Property: existential unforgeability of the submitted code

Cost against claim: few-time security of CEDRUS+C-160f down to ≈2¹⁵ after 2¹⁰ signatures

The message-hash routine sets the hypertree index to 0 and skips the digest bits the specification uses for it, and an unparenthesised macro drops two more leaf-index bits. Every signature therefore uses one of 2^{⌊h/d⌋−1} few-time instances (4 to 128, depending on the set) instead of 2^h, and the scheme's own few-time formula collapses after a few hundred signatures. Signing and verification share the wrong derivation, so the official test vectors reproduce and cannot reveal it.

Parameter set	Claim	Attack cost	Verdict
CEDRUS+C-160f	160 classical	≈2¹⁵ after 2¹⁰ signatures; ≈2⁹ after 2¹⁴	Minor break
CEDRUS+C-256f	256 classical	2⁶⁴ after 2¹⁰ signatures; ≈2¹⁰ after 2¹⁴	Minor break
CEDRUS+C-512s	512 classical	2³¹⁴ after 2¹⁴ signatures, falling as signatures accumulate	Minor break

Evidence

Instance counts measured on the shipped message-hash routine: 4 (160f), 8 (256f), 128 (512s), as predicted; 4, 64, 8, 64, 16, 128, 32 and 128 for the eight sets.
A forgery was executed on CEDRUS+C-160f.

Cause in the submitted code; the specification is not affected.

Designers' response

The designers fixed both defects in all eight sets and regenerated the test vectors (NGCC PKC Forum, 2026-09-22).

Credit

First public report: M.-J. Saarinen (ngcc.dev sign-03-1, 2026-09-21). Found independently by PQC-X.

cedrus-plus-c-i2

CEDRUS+C-512s accepts the ceiling of the specified digit sum

Holds · Argued · Cause: code

Property: conformance; no security loss from the rounding alone

Cost against claim: an off-by-one between specification and code

The code enforces the complementary digit sum. That equals the specified floor only when Σ(w_i − 1) is even; for CEDRUS+C-512s it is odd (3131), so the code accepts digit sum 1566 where the specification requires 1565, and the two cannot interoperate.

Parameter set	Claim	Attack cost	Verdict
CEDRUS+C-512s	specified digit sum	none	Holds

Evidence

Cause in the submitted code; the specification is not affected.

Credit

Found by PQC-X.