Computational cryptography › Multivariate
SIGNATUREPrimitive

UOV, MAYO

In plain words

A quantum-safe signature with tiny signatures but big public keys, unbroken for 25 years.

The idea: The public key is a big system of quadratic equations that looks random, and signing means solving it for the message's hash, which is hard in general. The secret: the equations were built from two kinds of variables, "oil" and "vinegar", where oil variables are never multiplied by each other. Knowing which is which, you fill in the vinegar variables at random, and what's left is a simple linear system you solve instantly. The scrambling that hides the oil and vinegar is the trapdoor.

Why it matters: A contender in NIST's ongoing signature competition.

The details

On the map: oil-and-vinegar trapdoor

Unbalanced Oil and Vinegar (1999)[1] hides a trapdoor inside quadratic equations and has stood for 25 years with proper parameters. Besides MQ, it needs that trapdoor to stay hidden: the balanced original fell to exactly that in 1998 (Kipnis and Shamir)[2]. MAYO shrinks UOV's large public keys[3].

Both advanced to round 3 of NIST's additional signature process in May 2026[4].

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Nothing on the map depends on it: it is an end point, something people use directly.

References

  1. Aviad Kipnis, Jacques Patarin and Louis Goubin. Unbalanced Oil and Vinegar Signature Schemes. Advances in Cryptology — EUROCRYPT ’99, 1999. doi:10.1007/3-540-48910-x_15
  2. Aviad Kipnis and Adi Shamir. Cryptanalysis of the oil and vinegar signature scheme. Advances in Cryptology — CRYPTO '98, 1998. doi:10.1007/bfb0055733
  3. Ward Beullens. MAYO: Practical Post-quantum Signatures from Oil-and-Vinegar Maps. Selected Areas in Cryptography, 2022. doi:10.1007/978-3-030-99277-4_17
  4. NIST. NIST Advances 9 Candidates to the 3rd Round of PQC. NIST CSRC news, 2026. csrc.nist.gov/News/2026/nist-advances-9-candidates-to-the-3rd-round-of-pqc