MQOM
MPCitH · Multivariate Quadratic · mqom.org(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- v3.0 ·
- Security flags
- None on current sets
Parameter sets
v3.0 · 31 Aug 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| L1-gf2-shorter-ct | 1 | 52 | 2,492 | 2,544 | 2.46 ms | 1.23 ms |
| L1-gf2-shorter-ot | 1 | 52 | 2,492 | 2,544 | 3.47 ms | 3.35 ms |
| L1-gf16-short-ct | 1 | 64 | 2,932 | 2,996 | 634.3 µs | 612.2 µs |
| L1-gf16-short-ot | 1 | 64 | 2,932 | 2,996 | 852.1 µs | 857.2 µs |
| L1-gf16-fast-ct | 1 | 64 | 3,316 | 3,380 | 236.5 µs | 226.7 µs |
| L1-gf16-fast-ot | 1 | 64 | 3,316 | 3,380 | 293.9 µs | 274.9 µs |
| L3-gf2-shorter-ct | 3 | 78 | 5,932 | 6,010 | 7.24 ms | 6.04 ms |
| L3-gf2-shorter-ot | 3 | 78 | 5,890 | 5,968 | 9.70 ms | 8.72 ms |
| L3-gf16-short-ct | 3 | 96 | 6,556 | 6,652 | 3.72 ms | 3.45 ms |
| L3-gf16-short-ot | 3 | 96 | 6,556 | 6,652 | 5.25 ms | 4.86 ms |
| L3-gf16-fast-ct | 3 | 96 | 7,564 | 7,660 | 1.10 ms | 1.07 ms |
| L3-gf16-fast-ot | 3 | 96 | 7,660 | 7,756 | 1.29 ms | 1.27 ms |
| L5-gf2-shorter-ct | 5 | 104 | 10,836 | 10,940 | 10.86 ms | 10.12 ms |
| L5-gf2-shorter-ot | 5 | 104 | 10,804 | 10,908 | 13.09 ms | 12.87 ms |
| L5-gf16-short-ct | 5 | 128 | 12,100 | 12,228 | 4.63 ms | 4.37 ms |
| L5-gf16-short-ot | 5 | 128 | 11,716 | 11,844 | 6.08 ms | 5.87 ms |
| L5-gf16-fast-ct | 5 | 128 | 13,540 | 13,668 | 1.88 ms | 1.77 ms |
| L5-gf16-fast-ot | 5 | 128 | 13,380 | 13,508 | 2.37 ms | 2.01 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| L1-gf2-shorter-ct new in v3.0 | 1 | — to 52 | — | — to 2,492 | — | — |
| L1-gf2-shorter-ot new in v3.0 | 1 | — to 52 | — | — to 2,492 | — | — |
| L1-gf16-short-ct new in v3.0 | 1 | — to 64 | — | — to 2,932 | — | — |
| L1-gf16-short-ot new in v3.0 | 1 | — to 64 | — | — to 2,932 | — | — |
| L1-gf16-fast-ct new in v3.0 | 1 | — to 64 | — | — to 3,316 | — | — |
| L1-gf16-fast-ot new in v3.0 | 1 | — to 64 | — | — to 3,316 | — | — |
| L3-gf2-shorter-ct new in v3.0 | 3 | — to 78 | — | — to 5,932 | — | — |
| L3-gf2-shorter-ot new in v3.0 | 3 | — to 78 | — | — to 5,890 | — | — |
| L3-gf16-short-ct new in v3.0 | 3 | — to 96 | — | — to 6,556 | — | — |
| L3-gf16-short-ot new in v3.0 | 3 | — to 96 | — | — to 6,556 | — | — |
| L3-gf16-fast-ct new in v3.0 | 3 | — to 96 | — | — to 7,564 | — | — |
| L3-gf16-fast-ot new in v3.0 | 3 | — to 96 | — | — to 7,660 | — | — |
| L5-gf2-shorter-ct new in v3.0 | 5 | — to 104 | — | — to 10,836 | — | — |
| L5-gf2-shorter-ot new in v3.0 | 5 | — to 104 | — | — to 10,804 | — | — |
| L5-gf16-short-ct new in v3.0 | 5 | — to 128 | — | — to 12,100 | — | — |
| L5-gf16-short-ot new in v3.0 | 5 | — to 128 | — | — to 11,716 | — | — |
| L5-gf16-fast-ct new in v3.0 | 5 | — to 128 | — | — to 13,540 | — | — |
| L5-gf16-fast-ot new in v3.0 | 5 | — to 128 | — | — to 13,380 | — | — |
| L1-gf2-short-3r not in v3.0 | 1 | 52 to — | — | 2,868 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf2-short-5r not in v3.0 | 1 | 52 to — | — | 2,820 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf16-short-3r not in v3.0 | 1 | 60 to — | — | 3,060 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf16-short-5r not in v3.0 | 1 | 60 to — | — | 2,916 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf256-short-3r not in v3.0 | 1 | 80 to — | — | 3,540 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf256-short-5r not in v3.0 | 1 | 80 to — | — | 3,156 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf2-fast-3r not in v3.0 | 1 | 52 to — | — | 3,212 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf2-fast-5r not in v3.0 | 1 | 52 to — | — | 3,144 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf16-fast-3r not in v3.0 | 1 | 60 to — | — | 3,484 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf16-fast-5r not in v3.0 | 1 | 60 to — | — | 3,280 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf256-fast-3r not in v3.0 | 1 | 80 to — | — | 4,164 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L1-gf256-fast-5r not in v3.0 | 1 | 80 to — | — | 3,620 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf2-short-3r not in v3.0 | 3 | 78 to — | — | 6,388 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf2-short-5r not in v3.0 | 3 | 78 to — | — | 6,280 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf16-short-3r not in v3.0 | 3 | 90 to — | — | 6,820 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf16-short-5r not in v3.0 | 3 | 90 to — | — | 6,496 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf256-short-3r not in v3.0 | 3 | 120 to — | — | 7,900 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf256-short-5r not in v3.0 | 3 | 120 to — | — | 7,036 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf2-fast-3r not in v3.0 | 3 | 78 to — | — | 7,576 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf2-fast-5r not in v3.0 | 3 | 78 to — | — | 7,414 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf16-fast-3r not in v3.0 | 3 | 90 to — | — | 8,224 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf16-fast-5r not in v3.0 | 3 | 90 to — | — | 7,738 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf256-fast-3r not in v3.0 | 3 | 120 to — | — | 9,844 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L3-gf256-fast-5r not in v3.0 | 3 | 120 to — | — | 8,548 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf2-short-3r not in v3.0 | 5 | 104 to — | — | 11,764 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf2-short-5r not in v3.0 | 5 | 104 to — | — | 11,564 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf16-short-3r not in v3.0 | 5 | 122 to — | — | 12,664 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf16-short-5r not in v3.0 | 5 | 122 to — | — | 12,014 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf256-short-3r not in v3.0 | 5 | 160 to — | — | 14,564 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf256-short-5r not in v3.0 | 5 | 160 to — | — | 12,964 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf2-fast-3r not in v3.0 | 5 | 104 to — | — | 13,412 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf2-fast-5r not in v3.0 | 5 | 104 to — | — | 13,124 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf16-fast-3r not in v3.0 | 5 | 122 to — | — | 14,708 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf16-fast-5r not in v3.0 | 5 | 122 to — | — | 13,772 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf256-fast-3r not in v3.0 | 5 | 160 to — | — | 17,444 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
| L5-gf256-fast-5r not in v3.0 | 5 | 160 to — | — | 15,140 to — | — | Warning. Passive full-key-recovery attack via saltless GGM root expansion (Delgado, ePrint 2026/1542): the v2.x spec (Algorithm 10) derives correlated roots with a fixed zero-salt PRG call, so repeated master seeds across signatures/keys/salts leak linear equations in the MQ witness, enabling full key recovery. Requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects all of Categories I/III/V, confirmed against every official tag v2.0.0–v2.1.1. Fix (salt-bound, domain-separated root expansion) is straightforward. |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site New version
v3.0
MQOM v3.0 released (round-3 spec): adds a One-Tree (OT) BLC variant alongside the existing Correlated-Tree (CT) one (tighter security reduction to the MQ problem, similar sizes, less implementation-friendly), a new gf2-shorter variant, and drops the gf256 and three-round (*-r3) variants, leaving 18 parameter sets (3 tradeoffs × 2 BLC variants × 3 categories). Fixes the salt-less GGM root-expansion issue below (ePrint 2026/1542) via domain-separated root expansion, confirmed in the spec's changelog — the v2.1 warning is dropped for v3.0. Also expands F16 parameters for additional security margin and adds ARM NEON optimized implementations.
- Attack
Passive full-key-recovery attack on MQOM v2 (Delgado, ePrint 2026/1542): the v2.x spec derives correlated GGM roots from a fresh master seed via a fixed, zero-salt PRG call (Algorithm 10), so repeated seeds across signatures, keys, and salts leak linear equations in the MQ witness. A parity-indexed XOR-collision attack recovers the complete signing key, but requires signature/query volumes at NIST's outer Q=2^64 permitted bound (~39% success in Category I) or substantial precomputation (tens of GiB–PiB of tables) to push higher; affects Categories I, III, and V, verified against every official tag from v2.0.0 through v2.1.1. Fix: salt-bound, domain-separated root expansion. v1.0 unaffected. Flagged as warning.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- added to site Update
Updated 7 schemes to their latest published specifications. PERK redesigned parameter sets (v2.2.0). MQOM adds gf16 variants (v2.1). RYDE and Mirath corrected signature sizes and added faster variants. CROSS, SQIsign, and MAYO updated with revised benchmarks.
- New version
v2.1
- New version
v2.0
- New version
v1.0