megascon-1
The 384-bit digest is a prefix of the 512-bit digest for short messages
Holds · Demonstrated · Cause: construction
Property: separation between instances
Cost against claim: relation between instances; no claimed property falls
Both digest sizes start from the same zero state, absorb the same padded bytes and never absorb the output length, so for every message shorter than 1024 bits the MEGASCON-384 digest is the first 384 bits of the MEGASCON-512 digest. Each digest is also a prefix of its XOF output.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| MEGASCON-384 / MEGASCON-512 | no claim of separation between instances | none | Holds |
Evidence
Checked on the official test vectors: 1024/1024 lengths.
Cause in the specification, traced to the specification text.
Credit
First public report: M.-J. Saarinen (ngcc.dev hash-18-1, 2026-09-21). Found independently by PQC-X.