Paper 2026/1542 Original: eprint.iacr.org/2026/1542 ↗

Signing-Key Recovery from Unsalted Root Expansion and Salt-Binding Repair for MQOM v2

Abstract

We give the first passive signing-key recovery attack on MQOM v2 in the classical EUF-CMA setting by exploiting the generation of the correlated GGM trees used in each signature. MQOM v2 expands a fresh $\lambda$-bit signature master seed, denoted $\mathsf{mseed}$ in the specification, with a PRG call whose salt input is always zero. A repeated $\mathsf{mseed}$ therefore produces the same GGM root seeds $\mathsf{rseed}[e]$, even when the signatures have different salts. For each execution, the BLC opening contains a sibling path whose top seed is either $\mathsf{rseed}[e]$ or its XOR with the first $\lambda$ bits of the secret MQ solution. When two signatures repeat $\mathsf{mseed}$ and the most significant bits of their hidden-leaf indexes differ, XORing the two top seeds cancels $\mathsf{rseed}[e]$ and reveals this secret prefix. The attacker can then recover a GGM root seed, reconstruct the corresponding tree and the secret MQ solution, and sign a fresh message. The value $\mathsf{mseed}$ is hidden, but the BLC openings provide enough information to detect its repetition. Storing the top sibling-path seeds from the first two executions together with their XOR finds every collision that can reveal the secret prefix. At the Category-I limit of $2^{64}$ signing queries, the attack succeeds with probability about $0.39$. The same zero-salt derivation also allows computations to be reused across public keys, parameter variants, and v2 releases, which yields the cross-key, exhaustive search, and precomputation extensions studied after the single-key attack. Executable tests against the official implementation recover signing keys and verify fresh-message forgeries. MQOM v3.0 binds root-seed derivation to the signature salt and execution index, removing the relation used by these attacks.