MAYO
Multivariate · Multivariate Quadratic · pqmayo.org(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- Round 3 ·
- Security flags
- Broken (1 of 34 sets) · Warning (1 of 34 sets)
Parameter sets
Round 3 · 31 Aug 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| five Recommended | 5 | 5,554 | 964 | 6,518 | 216.0 µs | 89.9 µs |
| three Recommended | 3 | 2,986 | 681 | 3,667 | 98.4 µs | 41.2 µs |
| two Recommended Broken | 1 | 2,928 | 239 | 3,167 | 29.2 µs | 12.2 µs |
| one Recommended Warning | 1 | 1,456 | 464 | 1,920 | 48.3 µs | 20.1 µs |
| alt (85 76 9 9 16) | 1 | 1,726 | 407 | 2,133 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (80 70 10 7 16) | 1 | 1,941 | 304 | 2,245 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (77 66 11 6 16) | 1 | 2,194 | 255 | 2,449 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (98 64 16 4 16) | 1 | 4,368 | 220 | 4,588 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (102 62 21 3 16) | 1 | 7,177 | 177 | 7,354 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (110 60 30 2 16) | 1 | 13,966 | 134 | 14,100 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (146 58 58 1 16) | 1 | 49,635 | 97 | 49,732 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (123 114 9 13 16) | 3 | 2,581 | 832 | 3,413 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (115 104 11 10 16) | 3 | 3,448 | 607 | 4,055 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (114 102 12 9 16) | 3 | 3,994 | 545 | 4,539 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (113 100 13 8 16) | 3 | 4,566 | 484 | 5,050 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (112 98 14 7 16) | 3 | 5,161 | 424 | 5,585 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (118 96 16 6 16) | 3 | 6,544 | 386 | 6,930 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (137 96 20 5 16) | 3 | 10,096 | 375 | 10,471 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (155 96 24 4 16) | 3 | 14,416 | 342 | 14,758 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (161 94 32 3 16) | 3 | 24,832 | 274 | 25,106 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (174 92 46 2 16) | 3 | 49,742 | 206 | 49,948 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (227 90 90 1 16) | 3 | 184,291 | 146 | 184,437 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (153 142 11 13 16) | 5 | 4,702 | 1,035 | 5,737 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (153 140 13 11 16) | 5 | 6,386 | 882 | 7,268 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (152 138 14 10 16) | 5 | 7,261 | 800 | 8,061 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (152 136 16 9 16) | 5 | 9,264 | 724 | 9,988 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (151 134 17 8 16) | 5 | 10,267 | 644 | 10,911 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (152 132 19 7 16) | 5 | 12,556 | 572 | 13,128 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (168 132 22 6 16) | 5 | 16,714 | 544 | 17,258 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (192 132 27 5 16) | 5 | 24,964 | 520 | 25,484 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (212 130 33 4 16) | 5 | 36,481 | 464 | 36,945 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (222 128 43 3 16) | 5 | 60,560 | 373 | 60,933 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (241 126 63 2 16) | 5 | 127,024 | 281 | 127,305 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
| alt (318 126 126 1 16) | 5 | 504,079 | 199 | 504,278 | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) | no code(No implementation of this alternative parameter set in the official code (MAYO-C implements only MAYO-one, -two, -three and -five)) |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (two): Structural forgery (Ostuzzi, ePrint 2026/2247, Table 6) lowers the estimated forgery cost from 2^144 to 2^140 bit operations, 3 bits below the 2^143 required for NIST Level I. The round-3 linear term blocks the paper's multi-target technique.
- Warning (one): Structural forgery (Ostuzzi, ePrint 2026/2247, Table 6) lowers the estimated forgery cost from 2^153 to 2^147 bit operations, still above the 2^143 required for NIST Level I.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| five | 5 | 5,554 to 5,554 | same | 964 to 964 | same | — |
| three | 3 | 2,986 to 2,986 | same | 681 to 681 | same | Flag cleared. Was Warning: Structural forgery combined with a multi-target reduction (Ostuzzi, ePrint 2026/2247, Table 5) lowers the estimated forgery cost from 2^223 to 2^207 bit operations, exactly the 2^207 required for NIST Level III. |
| two | 1 | 4,912 to 2,928 | 40%smaller | 186 to 239 | 28%larger | Broken. Structural forgery (Ostuzzi, ePrint 2026/2247, Table 6) lowers the estimated forgery cost from 2^144 to 2^140 bit operations, 3 bits below the 2^143 required for NIST Level I. The round-3 linear term blocks the paper's multi-target technique. |
| one | 1 | 1,420 to 1,456 | 3%larger | 454 to 464 | 2%larger | Warning. Structural forgery (Ostuzzi, ePrint 2026/2247, Table 6) lowers the estimated forgery cost from 2^153 to 2^147 bit operations, still above the 2^143 required for NIST Level I. |
| alt (85 76 9 9 16) new in Round 3 | 1 | — to 1,726 | — | — to 407 | — | — |
| alt (80 70 10 7 16) new in Round 3 | 1 | — to 1,941 | — | — to 304 | — | — |
| alt (77 66 11 6 16) new in Round 3 | 1 | — to 2,194 | — | — to 255 | — | — |
| alt (98 64 16 4 16) new in Round 3 | 1 | — to 4,368 | — | — to 220 | — | — |
| alt (102 62 21 3 16) new in Round 3 | 1 | — to 7,177 | — | — to 177 | — | — |
| alt (110 60 30 2 16) new in Round 3 | 1 | — to 13,966 | — | — to 134 | — | — |
| alt (146 58 58 1 16) new in Round 3 | 1 | — to 49,635 | — | — to 97 | — | — |
| alt (123 114 9 13 16) new in Round 3 | 3 | — to 2,581 | — | — to 832 | — | — |
| alt (115 104 11 10 16) new in Round 3 | 3 | — to 3,448 | — | — to 607 | — | — |
| alt (114 102 12 9 16) new in Round 3 | 3 | — to 3,994 | — | — to 545 | — | — |
| alt (113 100 13 8 16) new in Round 3 | 3 | — to 4,566 | — | — to 484 | — | — |
| alt (112 98 14 7 16) new in Round 3 | 3 | — to 5,161 | — | — to 424 | — | — |
| alt (118 96 16 6 16) new in Round 3 | 3 | — to 6,544 | — | — to 386 | — | — |
| alt (137 96 20 5 16) new in Round 3 | 3 | — to 10,096 | — | — to 375 | — | — |
| alt (155 96 24 4 16) new in Round 3 | 3 | — to 14,416 | — | — to 342 | — | — |
| alt (161 94 32 3 16) new in Round 3 | 3 | — to 24,832 | — | — to 274 | — | — |
| alt (174 92 46 2 16) new in Round 3 | 3 | — to 49,742 | — | — to 206 | — | — |
| alt (227 90 90 1 16) new in Round 3 | 3 | — to 184,291 | — | — to 146 | — | — |
| alt (153 142 11 13 16) new in Round 3 | 5 | — to 4,702 | — | — to 1,035 | — | — |
| alt (153 140 13 11 16) new in Round 3 | 5 | — to 6,386 | — | — to 882 | — | — |
| alt (152 138 14 10 16) new in Round 3 | 5 | — to 7,261 | — | — to 800 | — | — |
| alt (152 136 16 9 16) new in Round 3 | 5 | — to 9,264 | — | — to 724 | — | — |
| alt (151 134 17 8 16) new in Round 3 | 5 | — to 10,267 | — | — to 644 | — | — |
| alt (152 132 19 7 16) new in Round 3 | 5 | — to 12,556 | — | — to 572 | — | — |
| alt (168 132 22 6 16) new in Round 3 | 5 | — to 16,714 | — | — to 544 | — | — |
| alt (192 132 27 5 16) new in Round 3 | 5 | — to 24,964 | — | — to 520 | — | — |
| alt (212 130 33 4 16) new in Round 3 | 5 | — to 36,481 | — | — to 464 | — | — |
| alt (222 128 43 3 16) new in Round 3 | 5 | — to 60,560 | — | — to 373 | — | — |
| alt (241 126 63 2 16) new in Round 3 | 5 | — to 127,024 | — | — to 281 | — | — |
| alt (318 126 126 1 16) new in Round 3 | 5 | — to 504,079 | — | — to 199 | — | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- Update
ML-DSA, MAYO and ML-KEM: we moved our builds to the latest upstream code. ML-DSA uses the pq-crystals reference at d35ba3f, with two AVX2 conformance fixes by Gregor Seiler: the stricter infinity-norm check FIPS 204 requires (issue 113) and the rounding of
use_hintwhen the low part is zero (bba9534, reported by Eric Biggers). MAYO uses MAYO-C at 412cb8a, which makes the generic echelon-form routine constant-time; our GFNI/AVX-512 build uses the AVX2 echelon-form code, which this commit does not change. ML-KEM uses mlkem-native v2.0.0. Sizes are unchanged and upstream's known-answer tests pass for every set. We re-benchmarked all three on AWS c8i.4xlarge; the timings do not change beyond run-to-run variation. - added to site Update
Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.
- added to site Attack
Ostuzzi (ePrint 2026/2247) gives the first structural forgery on MAYO: whipping amplifies polar cancellations, which the Pseudo-Oil Attack exploits, and a separate multi-target reduction uses the homogeneity of the round-2 map. For round 2 the combination lowers the estimated forgery cost of MAYO1 from 2^146 to 2^128 bit operations, 15 bits below the 2^143 required for NIST Level I, and of MAYO3 from 2^223 to 2^207, exactly at the Level III requirement (Table 5); MAYO1 is now flagged broken and MAYO3 with a warning. The round-3 linear term blocks the multi-target reduction, and the structural attack alone lowers MAYO1, MAYO2 and MAYO3 from 2^153, 2^144 and 2^223 to 2^147, 2^140 and 2^221 (Table 6). MAYO2 falls 3 bits below Level I and is flagged broken; MAYO1 is flagged with a warning; MAYO3 is not flagged.
- added to site Attack
Merz and Ran (ePrint 2026/2181) extend the wedge attack with divided squares of the polar forms and Schur–Macaulay matrices, removing its parameter threshold and covering odd characteristic. The attack applies to every round-2 parameter set of UOV, MAYO, SNOVA and QR-UOV but one; four alternate round-2 MAYO sets, which the site does not list, fall below their claimed level. After their disclosure the MAYO team dropped a planned round-3 set and raised the parameters of MAYO2 (see the round-3 entry of 2026-08-31). No set shown on the site falls below its level.
- added to site New version
Round 3
MAYO published its round-3 spec (PDF): MAYO2's parameters change to increase its margin against the Wedge attack (Ran, ePrint 2025/1143), shrinking its public key from 4912B to 2928B while growing its signature from 186B to 239B; MAYO1 grows slightly (pk 1420→1456B, sig 454→464B) to push the improved-MQ attack (Asanuma et al., ePrint 2026/1054) margin back above the NIST Level I threshold — both flags are dropped for the round-3 parameter sets. Also adds an explicit linear term to the verification equation to block a newly disclosed claw-finding forgery attack, and fixes a low-rank weakness in the whipping schedule. MAYO3 and MAYO5 sizes are unchanged. The team also widened MAYO2's margin further in response to a new, not-yet-public UOV-like key-recovery attack privately disclosed by Lars Ran and Simon-Philipp Merz shortly before the deadline.
- added to site Attack
Improved MQ attack (Asanuma, Chen, Furue, Sakata & Takagi, ePrint 2026/1054) reduces MAYO1 classical security estimate from 2^156 to 2^145. Still above NIST Level I threshold (128 bits); flagged as warning.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- Attack
Updated UOV and MAYO security flags based on wedge attack (Ran, ePrint 2025/1143). MAYO-2 ("two") marked broken (~113 bits, below 128-bit threshold). UOV Ip, III, and V parameter sets marked with warning (reduced but still above threshold). UOV Is unaffected.
- added to site Update
Updated 7 schemes to their latest published specifications. PERK redesigned parameter sets (v2.2.0). MQOM adds gf16 variants (v2.1). RYDE and Mirath corrected signature sizes and added faster variants. CROSS, SQIsign, and MAYO updated with revised benchmarks.
- New version
Round 2
- New version
Round 2
- New version
Round 1