Signing-Key Recovery from Unsalted Root Expansion and Salt-Binding Repair for MQOM v2

본문 미리보기

We give the first passive classical EUF-CMA attack on MQOM v2 in which an optimal three-record parity-indexed XOR triangle detects every usable collision, recovers the complete signing key, and produces a fresh-message forgery. In MQOM v2, every correlated-GGM root is derived from a fresh $\lambda$-bit master seed using a fixed PRG call with zero salt, while a public opening reveals either the corresponding root or its XOR with a fixed prefix of the long-term MQ witness. The resulting root funct