UOV
Multivariate · UOV · uovsig.org(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- v3.0 ·
- Security flags
- None on current sets
Parameter sets
v3.0 · 7 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| V-pkc | 5 | 446,992 | 275 | 447,267 | 114.0 µs | 408.9 µs |
| V-classic | 5 | 3,232,320 | 275 | 3,232,595 | 113.8 µs | 130.2 µs |
| III-pkc | 3 | 189,232 | 209 | 189,441 | 39.7 µs | 173.6 µs |
| III-classic | 3 | 1,347,912 | 209 | 1,348,121 | 40.1 µs | 58.1 µs |
| Is-pkc | 1 | 66,576 | 96 | 66,672 | 17.5 µs | 48.3 µs |
| Is-classic | 1 | 412,160 | 96 | 412,256 | 17.3 µs | 12.5 µs |
| Ip-pkc | 1 | 46,591 | 135 | 46,726 | 14.2 µs | 43.8 µs |
| Ip-classic | 1 | 321,300 | 135 | 321,435 | 14.2 µs | 16.7 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| V-pkc | 5 | 446,992 to 446,992 | same | 260 to 275 | 6%larger | Flag cleared. Was Broken: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~223 bits, below NIST Level V threshold (best known; improves on Ran's ePrint 2025/1143 ~258 bits) |
| V-classic | 5 | 2,869,440 to 3,232,320 | 13%larger | 260 to 275 | 6%larger | Flag cleared. Was Broken: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~223 bits, below NIST Level V threshold (best known; improves on Ran's ePrint 2025/1143 ~258 bits) |
| III-pkc | 3 | 189,232 to 189,232 | same | 200 to 209 | 5%larger | Flag cleared. Was Broken: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~182 bits, below NIST Level III threshold (best known; improves on Ran's ePrint 2025/1143 ~207 bits) |
| III-classic | 3 | 1,225,440 to 1,347,912 | 10%larger | 200 to 209 | 5%larger | Flag cleared. Was Broken: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~182 bits, below NIST Level III threshold (best known; improves on Ran's ePrint 2025/1143 ~207 bits) |
| Is-pkc | 1 | 66,576 to 66,576 | same | 96 to 96 | same | Flag cleared. Was Warning: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~159 bits; above NIST Level I threshold but reduced from claimed 143 bits |
| Is-classic | 1 | 412,160 to 412,160 | same | 96 to 96 | same | Flag cleared. Was Warning: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~159 bits; above NIST Level I threshold but reduced from claimed 143 bits |
| Ip-pkc | 1 | 43,576 to 46,591 | 7%larger | 128 to 135 | 5%larger | Flag cleared. Was Broken: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~128 bits, below NIST Level I threshold (best known; improves on Ran's ePrint 2025/1143 ~141 bits) |
| Ip-classic | 1 | 278,432 to 321,300 | 15%larger | 128 to 135 | 5%larger | Flag cleared. Was Broken: Intersection attack (Furue & Ikematsu, ePrint 2026/298) reduces classical security to ~128 bits, below NIST Level I threshold (best known; improves on Ran's ePrint 2025/1143 ~141 bits) |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site Attack
Merz and Ran (ePrint 2026/2181) extend the wedge attack with divided squares of the polar forms and Schur–Macaulay matrices, removing its parameter threshold and covering odd characteristic. The attack applies to every round-2 parameter set of UOV, MAYO, SNOVA and QR-UOV but one; four alternate round-2 MAYO sets, which the site does not list, fall below their claimed level. After their disclosure the MAYO team dropped a planned round-3 set and raised the parameters of MAYO2 (see the round-3 entry of 2026-08-31). No set shown on the site falls below its level.
- added to site New version
v3.0
UOV round-3 parameter update (pqov/pqov): grows n at Levels I and III (Ip: n 112→119, m 44→45; III: n 184→193, m unchanged) and Level V (n 244→259, m unchanged), and adds a GFNI-optimized backend. Expanded-pk and signature sizes grow accordingly (compact-pk sizes are unchanged where m stayed fixed); Is (Level I, GF(16)) parameters are untouched. Not yet reflected on uovsig.org, which still serves the Feb-2025 round-2 package. Whether this fully re-addresses the intersection attack (Furue & Ikematsu, ePrint 2026/298) at the new parameter sizes has not been independently re-analyzed, so existing broken/warning flags are carried forward unchanged pending that analysis.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- Attack
Updated UOV security flags based on pℓ-truncated polynomial ring intersection attack (Furue & Ikematsu, ePrint 2026/298). Improves on Ran's wedge attack for Ip (~128 bits), III (~182 bits), V (~223 bits). Is parameter sets newly flagged as warning (~159 bits, still above threshold).
- Attack
Updated UOV and MAYO security flags based on wedge attack (Ran, ePrint 2025/1143). MAYO-2 ("two") marked broken (~113 bits, below 128-bit threshold). UOV Ip, III, and V parameter sets marked with warning (reduced but still above threshold). UOV Is unaffected.
- New version
v2.0
- New version
v1.0