History

Timeline of scheme data updates and security events tracked on this site.

  1. Attack

    Passive full-key-recovery attack on MQOM v2 (Delgado, ePrint 2026/1542): the v2.x spec derives correlated GGM roots from a fresh master seed via a fixed, zero-salt PRG call (Algorithm 10), so repeated seeds across signatures, keys, and salts leak linear equations in the MQ witness. A parity-indexed XOR-collision attack recovers the complete signing key, but requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success in Category I) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects Categories I, III, and V, verified against every official tag from v2.0.0 through v2.1.1. Fix: salt-bound, domain-separated root expansion. v1.0 unaffected. Flagged as warning.

    MQOM

  2. Milestone

    The HAWK team withdrew HAWK from NIST's additional signature standardisation process, citing the key-recovery attack below: naïve fixes such as doubling parameters or moving to higher-rank modules make HAWK uncompetitive with other lattice signatures. NIST confirmed the withdrawal and updated the round-3 candidates page accordingly. pqc-forum announcement.

    HAWK

  3. Attack

    Deterministic key-recovery attack (Straznickas & Weis, Anthropic, paper) reduces HAWK-n key recovery to poly(n) calls to an exact-SVP oracle in dimension n/2+1, using a second Galois involution (τ: ζ↦−ζ) beyond the complex conjugation prior module-LIP attacks relied on. Lowers key-recovery cost from 2^150 to 2^108 gates (HAWK-512) and from 2^288 to 2^182 gates (HAWK-1024), both below their NIST level thresholds. The smaller HAWK-256 challenge parameter set was fully broken in practice: secret key recovered end-to-end in a few hours on a single 96-core server. Falcon is unaffected. Flagged as broken.

    HAWK

  4. Attack

    Improved algorithm for the supersingular isogeny problem (ePrint 2026/1486) achieves time/memory p^{1/3+o(1)}, down from the previous best p^{1/2}. Relies on an unproven heuristic smoothness assumption and has a superpolynomial overhead plus high memory cost; concrete impact on SQIsign's parameters not yet clarified. Flagged as warning.

    SQIsign

  5. Update

    Added SMAUG-T (finalist algorithm selected in Korea's KpqC competition) to the KEMs comparison page, with benchmarked keygen/encaps/decaps timings for SMAUG-T128, SMAUG-T192, and SMAUG-T256.

    SMAUG-T

  6. Update

    Added NTRU+ (finalist algorithm selected in Korea's KpqC competition) to the KEMs comparison page, with benchmarked keygen/encaps/decaps timings for NTRU+768, NTRU+864, and NTRU+1152.

    NTRU+

  7. Update

    Added SABER (NIST round-3 finalist, not selected) to the KEMs comparison page, with benchmarked keygen/encaps/decaps timings for LightSaber, Saber, and FireSaber.

    SABER

  8. Update

    Published a standalone KEMs comparison page — public-key and ciphertext sizes plus keygen/encaps/decaps benchmarks for ML-KEM, HQC, and classical ECDH.

  9. Attack

    Improved MQ attack (Asanuma, Chen, Furue, Sakata & Takagi, ePrint 2026/1054) reduces MAYO1 classical security estimate from 2^156 to 2^145. Still above NIST Level I threshold (128 bits); flagged as warning.

    MAYO

  10. Update

    Updated FAEST performance data to use the AVX2+AES-NI optimized implementation (faest-arch-opt) instead of the reference implementation. Signing is 10–100× faster depending on the parameter set.

    FAEST

  11. Update

    Updated SNOVA to v2.3 (2026-04-03). Split round-2 and round-3 data: round-3 now shows the 14 current parameter sets from the v2.3 spec (l=4 variants retained with warnings, new q=19 variants, rectangular 4×5 structure added per "Rectangular signatures" update).

    SNOVA

  12. Milestone

    NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.

    FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV

  13. Attack

    Updated UOV security flags based on pℓ-truncated polynomial ring intersection attack (Furue & Ikematsu, ePrint 2026/298). Improves on Ran's wedge attack for Ip (~128 bits), III (~182 bits), V (~223 bits). Is parameter sets newly flagged as warning (~159 bits, still above threshold).

    UOV

  14. Attack

    Updated UOV and MAYO security flags based on wedge attack (Ran, ePrint 2025/1143). MAYO-2 ("two") marked broken (~113 bits, below 128-bit threshold). UOV Ip, III, and V parameter sets marked with warning (reduced but still above threshold). UOV Is unaffected.

    UOV, MAYO

  15. Attack

    Updated SNOVA security flags based on wedge product attack (Bros et al., ePrint 2026/237). 6 parameter sets marked broken: (37 17 2), (25 8 3), (56 25 2), (24 5 5), (75 33 2), (29 6 5). 2 parameter sets marked with warning: (24 5 4), (37 8 4).

    SNOVA

  16. Update

    Updated 7 schemes to their latest published specifications. PERK redesigned parameter sets (v2.2.0). MQOM adds gf16 variants (v2.1). RYDE and Mirath corrected signature sizes and added faster variants. CROSS, SQIsign, and MAYO updated with revised benchmarks.

    CROSS, MAYO, MQOM, Mirath, PERK, RYDE, SQIsign

  17. Update

    Fixed some typos in scheme data. commit

  18. Update

    Website rewritten with SvelteKit, Tailwind CSS v4, and a new round selector, filter panel, and scatter plot.

Built by Thom Wiggers / PQShield. Data licensed under CC BY-SA 4.0. Most recent scheme data is dated 2026-04-03.

GitHub · eBACS: more comprehensive benchmarks on more platforms