SNOVA
Multivariate · Non-comm. Ring UOV · snova.pqclab.org(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- v3.1 ·
- Security flags
- None on current sets
Parameter sets
v3.1 · 26 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| SNOVA_I_K Recommended | 1 | 376 | 528 | 904 | 210.3 µs | 64.9 µs |
| SNOVA_I_B Recommended | 1 | 656 | 388 | 1,044 | 209.7 µs | 58.5 µs |
| SNOVA_I_S Recommended | 1 | 1,016 | 272 | 1,288 | 142.6 µs | 47.6 µs |
| SNOVA_III_K Recommended | 3 | 912 | 688 | 1,600 | 439.4 µs | 134.9 µs |
| SNOVA_III_B Recommended | 3 | 1,416 | 532 | 1,948 | 457.2 µs | 135.6 µs |
| SNOVA_III_S Recommended | 3 | 2,032 | 456 | 2,488 | 515.3 µs | 139.2 µs |
| SNOVA_V_K Recommended | 5 | 1,216 | 896 | 2,112 | 1.10 ms | 261.1 µs |
| SNOVA_V_B Recommended | 5 | 1,891 | 691 | 2,582 | 1.10 ms | 217.8 µs |
| SNOVA_V_S Recommended | 5 | 2,716 | 591 | 3,307 | 1.17 ms | 209.0 µs |
| SNOVA (27 3 16 4 7 5 84) | 1 | 376 | 436 | 812 | 195.6 µs | 60.8 µs |
| SNOVA (27 4 16 4 5 5 80) | 1 | 656 | 326 | 982 | 186.5 µs | 55.9 µs |
| SNOVA (27 4 19 4 6 5 96) | 1 | 699 | 413 | 1,112 | 4.64 ms | 1.85 ms |
| SNOVA (27 5 13 4 4 5 80) | 1 | 950 | 255 | 1,205 | 3.48 ms | 1.25 ms |
| SNOVA (50 17 16 2 2 17 68) | 1 | 9,842 | 150 | 9,992 | 2.17 ms | 158.8 µs |
| SNOVA (27 4 16 5 5 4 100) | 3 | 816 | 404 | 1,220 | 370.2 µs | 74.5 µs |
| SNOVA (33 5 16 4 5 6 100) | 3 | 1,216 | 396 | 1,612 | 319.1 µs | 94.0 µs |
| SNOVA (39 5 11 4 6 7 120) | 3 | 1,241 | 478 | 1,719 | 11.60 ms | 4.71 ms |
| SNOVA (38 5 19 4 6 7 120) | 3 | 1,510 | 567 | 2,077 | 11.27 ms | 4.58 ms |
| SNOVA (76 25 16 2 2 25 100) | 3 | 31,266 | 218 | 31,484 | 10.22 ms | 565.4 µs |
| SNOVA (40 5 19 5 6 6 150) | 5 | 2,016 | 736 | 2,752 | 22.96 ms | 8.61 ms |
| SNOVA (47 6 19 4 6 9 144) | 5 | 2,781 | 695 | 3,476 | 22.69 ms | 8.49 ms |
| SNOVA (104 33 16 2 2 33 132) | 5 | 71,890 | 290 | 72,180 | 32.73 ms | 1.39 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| SNOVA_I_K | 1 | 376 to 376 | same | 528 to 528 | same | — |
| SNOVA_I_B | 1 | 656 to 656 | same | 388 to 388 | same | — |
| SNOVA_I_S | 1 | 1,016 to 1,016 | same | 272 to 272 | same | — |
| SNOVA_III_K | 3 | 912 to 912 | same | 688 to 688 | same | — |
| SNOVA_III_B | 3 | 1,416 to 1,416 | same | 532 to 532 | same | — |
| SNOVA_III_S | 3 | 2,032 to 2,032 | same | 456 to 456 | same | — |
| SNOVA_V_K | 5 | 1,216 to 1,216 | same | 896 to 896 | same | — |
| SNOVA_V_B | 5 | 1,891 to 1,891 | same | 691 to 691 | same | — |
| SNOVA_V_S | 5 | 2,716 to 2,716 | same | 591 to 591 | same | — |
| SNOVA (27 3 16 4 7 5 84) | 1 | 376 to 376 | same | 436 to 436 | same | — |
| SNOVA (27 4 16 4 5 5 80) | 1 | 656 to 656 | same | 326 to 326 | same | — |
| SNOVA (27 4 19 4 6 5 96) | 1 | 699 to 699 | same | 413 to 413 | same | Flag cleared. Was Broken: Key recovery from signatures: the vinegar sampler reduces uniform bytes modulo q^g, which is biased for odd q, turning key recovery into an LPN problem far below the claimed security (Beullens & Hess) |
| SNOVA (27 5 13 4 4 5 80) | 1 | 950 to 950 | same | 255 to 255 | same | Flag cleared. Was Broken: Key recovery from signatures: the vinegar sampler reduces uniform bytes modulo q^g, which is biased for odd q, turning key recovery into an LPN problem far below the claimed security (Beullens & Hess) |
| SNOVA (50 17 16 2 2 17 68) | 1 | 9,842 to 9,842 | same | 150 to 150 | same | — |
| SNOVA (27 4 16 5 5 4 100) | 3 | 816 to 816 | same | 404 to 404 | same | — |
| SNOVA (33 5 16 4 5 6 100) | 3 | 1,216 to 1,216 | same | 396 to 396 | same | — |
| SNOVA (39 5 11 4 6 7 120) | 3 | 1,241 to 1,241 | same | 478 to 478 | same | Flag cleared. Was Broken: Key recovery from signatures: the vinegar sampler reduces uniform bytes modulo q^g, which is biased for odd q, turning key recovery into an LPN problem far below the claimed security (Beullens & Hess) |
| SNOVA (38 5 19 4 6 7 120) | 3 | 1,510 to 1,510 | same | 567 to 567 | same | Flag cleared. Was Broken: Key recovery from signatures: the vinegar sampler reduces uniform bytes modulo q^g, which is biased for odd q, turning key recovery into an LPN problem far below the claimed security (Beullens & Hess) |
| SNOVA (76 25 16 2 2 25 100) | 3 | 31,266 to 31,266 | same | 218 to 218 | same | — |
| SNOVA (40 5 19 5 6 6 150) | 5 | 2,016 to 2,016 | same | 736 to 736 | same | Flag cleared. Was Broken: Key recovery from signatures: the vinegar sampler reduces uniform bytes modulo q^g, which is biased for odd q, turning key recovery into an LPN problem far below the claimed security (Beullens & Hess) |
| SNOVA (47 6 19 4 6 9 144) | 5 | 2,781 to 2,781 | same | 695 to 695 | same | Flag cleared. Was Broken: Key recovery from signatures: the vinegar sampler reduces uniform bytes modulo q^g, which is biased for odd q, turning key recovery into an LPN problem far below the claimed security (Beullens & Hess) |
| SNOVA (104 33 16 2 2 33 132) | 5 | 71,890 to 71,890 | same | 290 to 290 | same | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site Update
Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.
- added to site New version
v3.1
SNOVA v3.1 (specification, September 2026; code) samples the vinegar variables by rejection sampling for odd q. This removes the bias that Beullens & Hess used to recover keys of the six odd-characteristic alternative sets of v3.0; those sets keep their broken flags under v3.0. Parameters and sizes are unchanged, and the q = 16 sets sample as before. We now build v3.1 (upstream commit ebdd7e2, which also fixes table initialisation in the reference
pk_expand()) and benchmarked it on AWS c8i.4xlarge on 2026-11-12, the instance type of all other signature timings. - added to site Attack
Merz and Ran (ePrint 2026/2181) extend the wedge attack with divided squares of the polar forms and Schur–Macaulay matrices, removing its parameter threshold and covering odd characteristic. The attack applies to every round-2 parameter set of UOV, MAYO, SNOVA and QR-UOV but one; four alternate round-2 MAYO sets, which the site does not list, fall below their claimed level. After their disclosure the MAYO team dropped a planned round-3 set and raised the parameters of MAYO2 (see the round-3 entry of 2026-08-31). No set shown on the site falls below its level.
- Attack
Key-recovery attack on SNOVA's biased vinegar sampling (Beullens & Hess, IBM Research, pqc-forum OFFICIAL COMMENT, paper to appear on ePrint): the round-3 signer draws vinegar variables by reducing uniform byte strings modulo q^g, which is never uniform when q is odd, so every signature yields noisy linear equations in the secret transformation T. Key recovery becomes a q-ary LPN problem with a known full-support error distribution, solved with BKW reduction plus Fourier hypothesis testing. This affects only the six odd-characteristic alternative parameter sets of Table 6 in the round-3 spec — (27 4 19 4 6), (27 5 13 4 4), (39 5 11 4 6), (38 5 19 4 6), (40 5 19 5 6) and (47 6 19 4 6) — all of which fall far below their claimed 170–331 bits (2^90–2^130 operations from ~6–11k signatures). Four were broken end to end against the unmodified reference implementation: 9M, 16.5M, 9M and 180M signatures recovered in 22s, 34s, 22s and 16min respectively (proof of concept). The recommended parameter sets shown here (SNOVA_{I,III,V}_{K,B,S}) use q = 16 and are unaffected, since 16^g divides 256^b exactly; no flags are changed for them. The fix is simple: sample the vinegar variables uniformly, e.g. by rejection sampling as QR-UOV does. The first version of the attack was found independently by an AI system (gpt-5.6-sol); the authors verified it, improved it and wrote it up.
- added to site New version
v3.0
SNOVA 3.0 (round-3 submission) reformulates the public map to support rectangular signature matrices, extending the scheme to seven parameters (v, o, q, l, r, m1, m2) and adding parameter sets over odd-characteristic fields. The recommended parameter sets (SNOVA_{I,III,V}_{K,B,S}) replace the previous v2.3 candidates; per the spec's security analysis (Tables 9–11), the Wedge product attack (Bros et al., ePrint 2026/237) that flagged several v2.3 parameter sets as broken/warning no longer applies to the reformulated public map. The “Expanded Secret Key” option is removed; only seeded secret keys remain.
- Update
Updated SNOVA to v2.3 (2026-04-03). Split round-2 and round-3 data: round-3 now shows the 14 current parameter sets from the v2.3 spec (l=4 variants retained with warnings, new q=19 variants, rectangular 4×5 structure added per "Rectangular signatures" update).
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- Attack
Updated SNOVA security flags based on wedge product attack (Bros et al., ePrint 2026/237). 6 parameter sets marked broken: (37 17 2), (25 8 3), (56 25 2), (24 5 5), (75 33 2), (29 6 5). 2 parameter sets marked with warning: (24 5 4), (37 8 4).
- New version
v2.3
- New version
v2.0
- New version
Round 1