Tins

Tins-128 falls below the call's quantum floor

Minor break · Argued · Cause: parameter size

Property: existential unforgeability, quantum

Cost against claim: ≈2⁶⁹ quantum against the required 2⁸⁰

The designers apply Grover's speed-up to their seed search only, not to their own classical bottleneck attack. Doing so gives about 2⁶⁹ for Tins-128, in the same cost metric as their own figure, below the 80 bits the call requires at level 128. Tins-256 and -512 land exactly on their quantum requirement.

Evidence

Cause in the specification, traced to the specification text.

Limits

A quantum cost; fixed by larger parameters.

Credit

Found by PQC-X.

The Tins-128 verifier compares against a variable it never assigns

Holds · Demonstrated · Cause: code

Property: correctness of verification; no claimed property shown to fall

Cost against claim: undefined behaviour in verification; not shown exploitable

In the Tins-128 code (reference, optimised and additional), verification compares the recomputed hash with a variable that is never assigned, which is undefined behaviour in C. A hardened rebuild rejects every signature. Tins-256 and -512 are correct.

Evidence

Cause in the submitted code; the specification is not affected.

Credit

Found by PQC-X.