Paper 2024/219

Singular points of UOV and VOX

Abstract

In this work, we study the singular locus of the varieties defined by the public keys of UOV and VOX, two multivariate signature schemes submitted to the additional NIST call for post-quantum signature schemes. We give a new attack for $\widehat{+}$ and VOX targeting singular points of the underlying UOV key. Our attack lowers the security of the schemes, both asymptotically and in number of gates, showing in particular that the parameter sets proposed for these schemes do not meet the NIST security requirements. More precisely, we show that the security of VOX/UOV$$ was overestimated by factors $$ for security levels I, III, V respectively. As an essential element of the attack on VOX, we introduce a polynomial time algorithm performing a key recovery from one vector, with an implementation requiring only $$ seconds at security level V.

Note: Revision 2024-09-02: Corrected technical lemmas, improved key recovery from one vector in VOX (exp -> polytime). Revision 2025-02-17: Added generic smoothness, improved technical lemmas.