QR-UOV
Multivariate · UOV · info.isl.ntt.co.jp(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- Round 3 ·
- Security flags
- None on current sets
Parameter sets
Round 3 · 31 Aug 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| I-(127 156 54 3) Recommended | 1 | 24,256 | 200 | 24,456 | 139.4 µs | 77.5 µs |
| I-(127 540 60 10) Recommended | 1 | 11,041 | 541 | 11,582 | 665.3 µs | 217.4 µs |
| III-(127 228 78 3) Recommended | 3 | 71,884 | 292 | 72,176 | 376.4 µs | 218.7 µs |
| III-(127 820 90 10) Recommended | 3 | 35,454 | 821 | 36,275 | 2.16 ms | 713.4 µs |
| V-(127 306 105 3) Recommended | 5 | 173,660 | 392 | 174,052 | 885.8 µs | 523.4 µs |
| V-(127 1040 110 10) Recommended | 5 | 63,541 | 1,039 | 64,580 | 3.82 ms | 1.33 ms |
| I-(7 740 100 10) | 1 | 20,641 | 331 | 20,972 | 2.15 ms | 625.2 µs |
| I-(31 165 60 3) | 1 | 23,641 | 157 | 23,798 | 194.2 µs | 82.9 µs |
| I-(31 600 70 10) | 1 | 12,266 | 435 | 12,701 | 896.4 µs | 251.2 µs |
| III-(7 1100 140 10) | 3 | 55,141 | 489 | 55,630 | 6.29 ms | 1.85 ms |
| III-(31 246 87 3) | 3 | 70,976 | 233 | 71,209 | 536.9 µs | 238.8 µs |
| III-(31 890 100 10) | 3 | 34,391 | 643 | 35,034 | 2.78 ms | 736.3 µs |
| V-(7 1490 190 10) | 5 | 135,391 | 662 | 136,053 | 14.79 ms | 4.55 ms |
| V-(31 324 114 3) | 5 | 158,405 | 306 | 158,711 | 1.08 ms | 517.3 µs |
| V-(31 1120 120 10) | 5 | 58,516 | 807 | 59,323 | 4.87 ms | 1.36 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| I-(127 156 54 3) | 1 | 24,256 to 24,256 | same | 200 to 200 | same | — |
| I-(127 540 60 10) new in Round 3 | 1 | — to 11,041 | — | — to 541 | — | — |
| III-(127 228 78 3) | 3 | 71,892 to 71,884 | <0.1%smaller | 292 to 292 | same | — |
| III-(127 820 90 10) new in Round 3 | 3 | — to 35,454 | — | — to 821 | — | — |
| V-(127 306 105 3) | 5 | 173,676 to 173,660 | <0.1%smaller | 392 to 392 | same | — |
| V-(127 1040 110 10) new in Round 3 | 5 | — to 63,541 | — | — to 1,039 | — | — |
| I-(7 740 100 10) | 1 | 20,641 to 20,641 | same | 331 to 331 | same | — |
| I-(31 165 60 3) | 1 | 23,641 to 23,641 | same | 157 to 157 | same | — |
| I-(31 600 70 10) | 1 | 12,266 to 12,266 | same | 435 to 435 | same | — |
| III-(7 1100 140 10) | 3 | 55,149 to 55,141 | <0.1%smaller | 489 to 489 | same | — |
| III-(31 246 87 3) | 3 | 70,984 to 70,976 | <0.1%smaller | 233 to 233 | same | — |
| III-(31 890 100 10) | 3 | 34,399 to 34,391 | <0.1%smaller | 643 to 643 | same | — |
| V-(7 1490 190 10) | 5 | 135,407 to 135,391 | <0.1%smaller | 662 to 662 | same | — |
| V-(31 324 114 3) | 5 | 158,421 to 158,405 | <0.1%smaller | 306 to 306 | same | — |
| V-(31 1120 120 10) | 5 | 58,532 to 58,516 | <0.1%smaller | 807 to 807 | same | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site Update
QR-UOV rounds 1 and 2: key and signature sizes now follow the submitted code where it differs from the specification. In both rounds the public keys of I-(127, 156, 54, 3) and III-(127, 228, 78, 3) and the public key and signature of III-(31, 246, 87, 3) are one byte larger (round 2: 24,256, 71,892, and 70,984 and 233 bytes). The round-1 code builds III-(7, 1100, 140, 10) with v = 1150, so its signature is 508 bytes instead of the specification's 489. Each changed set notes the specification's value.
- added to site Update
Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.
- added to site Attack
Merz and Ran (ePrint 2026/2181) extend the wedge attack with divided squares of the polar forms and Schur–Macaulay matrices, removing its parameter threshold and covering odd characteristic. The attack applies to every round-2 parameter set of UOV, MAYO, SNOVA and QR-UOV but one; four alternate round-2 MAYO sets, which the site does not list, fall below their claimed level. After their disclosure the MAYO team dropped a planned round-3 set and raised the parameters of MAYO2 (see the round-3 entry of 2026-08-31). No set shown on the site falls below its level.
- added to site New version
Round 3
QR-UOV Round 3 submission (specification, github.com/qruov/round3): the parameter set list is cut from twelve to six, all with q = 127 — the q = 31 and q = 7 sets are dropped — and three new small-public-key sets with ℓ = 10 are added (I-(127 540 60 10), III-(127 820 90 10), V-(127 1040 110 10)), e.g. an 11,041-byte public key at Level I for a 541-byte signature. The secret key is now the 32-byte seed alone at every level, and signing rejects oil systems of rank below m − 2. A new AVX2 implementation (Amagasa, Ueno & Homma, TCHES 2026(2)) replaces the Round 2 avx2/avx512 code. Benchmarks here switch to that AVX2 implementation with the AES-based public-seed PRG (upstream's default), so the speedup over Round 2 combines the new implementation with the SHAKE→AES PRG change.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- New version
Round 2
- New version
Round 1