The oldest register word is read once and discarded: collisions, second preimages, multicollisions
Practical · Demonstrated · Cause: construction
Property: collision and second-preimage resistance
Cost against claim: collision in ≈216.3 feedback evaluations (under a second), against 2256 to 2512
In every round, the oldest word of each register module is read only by the feedback function and is then shifted out. Two states that differ only in that word and give the same feedback value are equal one round later. The message fills whole modules, oldest word included, so a birthday search over a single 32-bit message word yields full-digest collisions from any chaining value.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| Neulaser-512, -768, -1024 | collision 2256 to 2512; second preimage ≈2512 to 21024 | collision ≈216.3 feedback evaluations; second preimage ≈217 | Practical |
What causes it
- The oldest word enters only the feedback function F; the global mixing reads other stages; the shift drops it.
- The feedback value is additively separable in the two 16-bit halves of that word, so all second values are found in 217 by meet-in-the-middle.
The specification itself notes that a concrete bound must add the generator's distinguishing advantage; that advantage is close to 1 after 216 queries.
Evidence
- A model rebuilt from the specification reproduces every official test vector of the three instances; 388/388 digest collisions over 32 readings, mean cost 216.33 feedback evaluations.
- On the unmodified reference code: black-box collisions on all three sizes in 1 to 2 seconds (none in 106 control tries), and a second preimage of the official Neulaser-512 test-vector message that gives the official digest.
- 26-multicollisions, 316/316 pairs confirmed on the reference.
Cause in the specification: the attack also works on a model built from the specification alone.
Limits
The two messages have equal length and differ in one 32-bit word that lands in an oldest register stage. A second preimage succeeds with probability ≈63% per usable word. Preimages are not affected. The specification never states the loading order of its inputs; 6 of the 8 conceivable orders are vulnerable, and the other 2, which contradict the notation and the test vectors, allow free-start collisions only.
What PQC-X adds
Second preimages of the official test-vector messages, found by meet-in-the-middle in about 217 thanks to the separability of the feedback function; collisions from any chaining value, not only from the fixed IV; and the check of every loading order the specification leaves open.
Credit
First public report: Cryptanalysts001 (ISCAS) (CryptHash forum, also ngcc.dev hash-21-1, 2026-09-22). Found independently by PQC-X.
Related public reports:
- Y. Yuan et al. (ISCAS, UCAS) (ePrint 2026/2152, 2026-09-22): the collisions, in a paper on seven NGCC hash functions.
- Tsinghua Hash Lab (ngcc.dev hash-21-2, 2026-09-22): a second, independent route to state mergers, through the reduction modulo 232 − 5; not reproduced by PQC-X.