Phoenix

Two parameter sets fall just short of their category at 2⁶⁴ signatures

Holds · Argued · Cause: parameter size

Property: existential unforgeability at the call's 2⁶⁴ signatures per key

Cost against claim: 2^254.25 against 2²⁵⁶ (256f); 2^507.53 against 2⁵¹² (512s): within 8 bits, the claim stands

Computed exactly, with the hypergeometric distribution of distinct covered sets (the designers' formula is its mean-field approximation), the few-time layer's security after the 2⁶⁴ signatures per key the call requires leaves Phoenix-256f and Phoenix-512s slightly below their category, classically and quantumly. The 192- and 384-bit sets, 256s and 512f meet it.

Evidence

Exact computation carried to 600 digits, after a catastrophic cancellation at low precision was caught.

Cause in the specification, traced to the specification text.

Limits

A shortfall of 1 to 4.5 bits classically, far from any forgery; fixed by slightly larger parameters. Phoenix-128 is a toy example by the designers' own statement and is not assessed.

Credit

Found by PQC-X.

The shipped SM3 build rejects all ten of its own test vectors

Holds · Demonstrated · Cause: code

Property: conformance of the submitted SM3 code and test vectors

Cost against claim: code and test vectors come from two incompatible implementations

Built from the shipped sources, the SM3 versions reject all 10 official vectors of each set checked, while the same binaries accept what they sign themselves and the SHAKE build verifies 10/10. At identical counters and indices the source and the vectors use disjoint few-time leaf secrets: they come from two incompatible implementations, in the SM3 half the call mandates.

Evidence

Cause in the submitted code; the specification is not affected.

Limits

No attack follows: the shipped source is sound and follows the specification.

Credit

Found by PQC-X.