MasterCube

The security argument covers neither the specified function nor the submitted one

Security proof gap · Demonstrated · Cause: specification text

Property: the designers' security argument

Cost against claim: proof gap; no attack follows

The argument of §4.2 rests on combining a forward branch with its inverse. The specification's own Algorithm 2 is not an inverse of the forward round, and the transformation the official test vectors define is not the specified one either: MixColumns is applied un-inverted in the backward branch, a placement no reading of the text gives, and the round constants are RC[17..9] instead of the RC[0..8] of Algorithm 4. No reading among 589,824 tried reproduces the official data from the text.

Evidence

A model built from the specification agrees with the official test vectors only once those departures are applied; the inverse identity fails in both the specified and the submitted versions.

Cause in the specification: the attack also works on a model built from the specification alone.

Limits

No attack follows from this. It leaves the design without a valid security argument.

Credit

First public report: Cryptanalysts001 (ISCAS) (CryptHash forum, also ngcc.dev hash-17-2, 2026-09-22). Found independently by PQC-X.

The submitted code never adds the extra padding block

Minor break · Demonstrated · Cause: code

Property: collision resistance of the submitted function

Cost against claim: 1 evaluation, against 2²⁵⁶ to 2⁵¹²

The code pads in place and omits the extra block that the specified pad10*1 requires when the message length is r − 1 modulo the rate. Hence H(X) = H(X‖1‖0^{r−2−|X| mod r}) for every X with |X| mod r ≤ r − 2; for example H(ε) = H(1‖0⁹⁵⁸) for MasterCube-512. Eighteen official test vectors embody the collapse.

Evidence

• A model that follows the specified padding agrees with the official test vectors except on exactly those 18 lengths.
• Collisions on all three sizes with the reference code; the official 959-bit test-vector message and its 958-bit prefix both give the official digest.

Cause in the submitted code; the specification is not affected.

Limits

Only bit lengths ≡ r − 1 (mod r), hence ≡ 7 (mod 8), are mis-padded; byte-oriented use cannot trigger it.

Credit

First public report: M.-J. Saarinen (ngcc.dev hash-17-1, 2026-09-21). Found independently by PQC-X.