A fast multivariate signature for smart cards, recommended by Europe's NESSIE project in 2003 and broken in 2007.
The idea: SFLASH hid part of C*'s output (the "minus" modification) so Patarin's equations would stop working. The 2007 attack found that the hidden map still had a symmetry that could be used to rebuild the missing outputs, after which Patarin's old attack worked again.
Why it matters: A reminder that a standards body's approval isn't proof of security.
On the map: ✗ recommended by NESSIE (2003)
A fast, short multivariate signature built on C* with the minus modification. The European NESSIE project recommended it in 2003 for low-cost smart cards[1]. The 2007 attack was practical on an ordinary computer[2].
Like SIKE and Rainbow, it shows that a standards body's approval is not proof of security.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.