MQOM v2.1, a NIST Round-3 Signature Candidate, Falls to Full Key Recovery From a Single Accepted Signature

arXiv 2608.09699·medium signalXBlueskyLinkedInCopy link

Posted 2026-08-10, this attack recovers the complete signing key of MQOM v2.1 — a Round-3 candidate in NIST's additional-signature process — from one accepted signature, then uses it to forge a fresh message accepted by the reference verifier. The sibling path fixes a public value A so tree parity gives s = δ ⊕ A; substituting into the hidden-leaf commitment yields an equation in public values K and T, and the in-signature correction expands a solution into a complete witness. Complete-domain scans cost 2^142.3 and 2^271.8 Boolean gates for Categories I and V — all four reported totals sit below NIST's security benchmarks. Reduced-domain runs recovered byte-exact keys in all three categories.