Four identical words in every round constant: a lane symmetry that survives all rounds
Practical · Tested at small scale · Cause: construction
Property: collision resistance
Cost against claim: CHIME-512 collision ≈264 against 2256; CHIME-1024 ≈2161 against 2512
The round constant is XORed identically into the four 64-bit lanes, and every other step treats lanes uniformly. The permutation therefore keeps, at any number of rounds, the subspace where the four lanes of every array are equal, and it commutes with swapping the two halves of every array. For CHIME-512, messages that stay in that subspace give digests with only 2128 possible values.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| CHIME-512 | collision 2256 | ≈264 | Practical |
| CHIME-1024 | collision 2512 | ≈2161 to 2163 | Theoretical |
What causes it
- The specification fixes every round constant as four identical 64-bit words.
- Shifts and rotations act on each 64-bit word independently; the shuffles act identically on both halves or move whole lanes; χ is bitwise.
- CHIME-512 is a plain sponge with IV = 0, which lies in the invariant subspace. CHIME-1024 has a capacity feed-forward and a flag before the last block, but its non-final blocks can still be kept in the subspace, which leaves 320 bits of capacity entropy.
The designers' analysis assumes a random permutation and states that no exploitable structural weakness exists.
Evidence
- A collision on a fixed 256-bit half of the CHIME-512 digest was found in 219 seconds (232 work, generic 2128); collisions on fixed 128-bit subsets in 214 to 217 (generic 264). The call evaluates collisions on fixed output subsets explicitly.
- A distinguisher of probability 1 from two queries: H(ρM) = ρH(M).
- The symmetry holds 1000/1000 at 1, 7, 15 and 20 rounds on the reference code; steering for CHIME-1024 200/200. Every ingredient of the full collisions is measured; the final birthday searches are not run.
Cause in the specification: the attack also works on a model built from the specification alone.
Limits
The colliding messages are structured: they repeat 64-bit words, and their length modulo 512 must lie in [447, 510]. No preimage attack on random targets. CHIME-1024 has no digest-level distinguisher, because its flag breaks the symmetry.
Designers' response
The designers published an erratum that makes the four words of each round constant distinct, which removes the symmetry (CryptHash forum, 2026-09-22). This entry concerns the round-1 submission; PQC-X has not checked the erratum.
What PQC-X adds
Actual collisions on fixed output subsets (a 256-bit half found, and 128-bit subsets), which the call evaluates in their own right; and a lower bound for CHIME-1024: about 2161 to 2163 by steering the non-final blocks, against the 2224 published before.
Credit
First public report: Cryptanalysts001 (ISCAS) (CryptHash forum, also ngcc.dev hash-26-1, 2026-09-22). Found independently by PQC-X.
Related public reports:
- Y. Yuan et al. (ISCAS, UCAS) (ePrint 2026/2152, 2026-09-22): the same invariant subspace and the 264 collision bound, in a paper on seven NGCC hash functions.