YuanYang.DSA

The reference signer builds the perturbation covariance from the Gram matrix instead of the frame operator, leaking secret-basis information

Security proof gap · Argued · Cause: code

Property: existential unforgeability (the zero-knowledge argument)

Cost against claim: covariance leak measured at YuanYang.DSA-512; no key-recovery algorithm established, an estimate needs roughly 10⁶ to 10⁷ signatures, far below 2¹²⁸

Scope: The reference and optimized implementations, all three parameter sets (identical source); quantitatively measured only at 512.

Signature generation samples a perturbation meant to make the signer's output spherical, independent of the secret basis. The reference code instead builds its covariance from the Gram matrix B̂*B̂ rather than the frame operator B̂B̂ᵗ that the specification's Algorithm 7 asks for, so each signature's second moment carries a term η²(B̂B̂* − B̂*B̂) that depends on the secret basis and not only on the lattice. Measured on a fresh key at YuanYang.DSA-512 over 4000 signatures, the ratio ‖s2‖²/‖s1‖² is 1.088 against 1.001/0.999 for spherical controls, and the deviation fits the predicted secret-dependent term with slope 1.02. No key-recovery algorithm from the leak has been demonstrated.

What causes it

The specification fixes bases by columns (§2), so for B̂ = [b1 | b̂2] the frame operator is B̂B̂ᵗ = b1b1* + b̂2b̂2*; Algorithm 7 line 6 (p. 11) sets Σp ← σ²I − B̂B̂ᵗ, which Algorithm 8's target v ~ D_{L,c,σsig} (p. 12) needs spherical. The code's keygen/perturbation.c, sigma_p_set_slot (lines 83 to 105), instead sets Σp_00 = σ² − (|f|²+|g|²), Σp_11 = σ² − (|F̂|²+|Ĝ|²), Σp_01 = −(f̄F̂ + ḡĜ): the Gram matrix σ²I − B̂*B̂. sign.c, recover_sampler_centers (lines 354 to 387), then subtracts the perturbation in the ambient space before applying B̂⁻¹, so the effective per-slot output covariance becomes σsig²I + η²(B̂B̂* − B̂*B̂). The identical lines appear in all six builds (reference and optimized, at 512, 1024 and 2048).

Evidence

On a fresh key at YuanYang.DSA-512 (unmodified reference code, whose 512 KAT was reproduced byte for byte), an independent harness (own decoder against the designers' API, own statistics computing the full per-slot 2x2 Hermitian covariance) measured ‖s2‖²/‖s1‖² = 1.088 ± 0.001 and a split-half correlation of 0.98 over 4000 signatures, against 1.001/0.999 and about 0 for an i.i.d. spherical control and for a float re-implementation of Algorithm 10 using the specification's own Σp; a float re-implementation using the code's Σp reproduces 1.078 and the same fit. Also measured, and not in the public report: a per-coefficient mean of about +4.7 (s1) and +5.3 (s2), against an ideal mean of 0. Key recovery from the leak was not attempted: estimating the leaked covariance to working precision needs on the order of 10⁶ to 10⁷ signatures by a rough count, and no algorithm from that estimate to the secret basis was written or costed, so no cost below the claimed level is established. A second member of PQC-X reproduced the 512 KAT match and reviewed the harness and the fit against the code's own Σp formula.

Cause in the submitted code; the specification is not affected.

Limits

Measured only at YuanYang.DSA-512, on one fresh key and the two keys already used to claim the leak; the identical source in the 1024 and 2048 builds was located by inspection, not measured, and a second fresh key at 512 was paused before completion. Key recovery is not established: no attack, demonstration or cost is given, only the covariance leak itself.

Credit

First public report: Kris Kwiatkowski (ngcc.dev sign-34-1, 2026-09-22). Found independently by PQC-X.