VDOO · PQC-X

A stronger public report is awaiting reproduction.

Peigen Li (PKC forum, 2026-09-22): an estimate of 379 bits for VDOO-512, whose details are not given in the forum.

PQC-X lists a third party's break once it has reproduced it; until then this page shows PQC-X's own results only.

Design

Holds Whether VDOO-512 meets its level depends on the linear-algebra constant

vdoo-1

Whether VDOO-512 meets its level depends on the linear-algebra constant

Holds · Argued · Cause: parameter size

Property: existential unforgeability

Cost against claim: direct forgery 2^508.4 at ω = 2, 2^524.4 at ω = 2.81, against 2⁵¹²

The best direct forgery on VDOO-512 costs 2^508.4 if linear algebra costs n² and 2^524.4 with ω = 2.81: the verdict rests on the constant alone. VDOO-256 meets its level with no redundancy (2^257.6 at ω = 2), where the call asks for some.

Parameter set	Claim	Attack cost	Verdict
VDOO-512	512 classical	2^508.4 (ω = 2) to 2^524.4 (ω = 2.81)	Holds
VDOO-256	256 classical	2^257.6 (ω = 2)	Holds

Evidence

Cause in the specification, traced to the specification text.

Credit

Found by PQC-X.

Implementation

Bugs in the submitted code; the specification is sound on these points.

Minor break Key generation's random generator is never seeded: every deployment gets the same key pair

vdoo-i1

Key generation's random generator is never seeded: every deployment gets the same key pair

Minor break · Demonstrated · Cause: code

Property: secret key, for the submitted code

Cost against claim: the secret key is public: anyone regenerates it

On the NGCC interface path, in both the reference and the optimised code, the generator that feeds key generation is never seeded, so key generation returns the same key pair whatever seed the caller supplies; the official test vectors do not depend on their own seeds. The standalone key-generation tool does seed it, which may be why the defect went unnoticed.

Parameter set	Claim	Attack cost	Verdict
all VDOO sets, NGCC interface	128 to 512 classical	none: the key is reproducible	Minor break

Evidence

Cause in the submitted code; the specification is not affected.

Limits

Signing draws from the same unseeded generator; the resulting reuse of vinegar values is a key-recovery route that PQC-X has argued but not run.

Credit

First public report: M.-J. Saarinen (ngcc.dev sign-33-1, 2026-09-21). Found independently by PQC-X.

Related public reports:

M.-J. Saarinen (ngcc.dev sign-33-4, 2026-09-21): signing reuses the same predictable randomness.