A 512-bit message digest at every level caps TSUOV-512 at 256 bits
Minor break · Argued · Cause: parameter size
Property: existential unforgeability
Cost against claim: digest collision 2256 against 2512
TSUOV compresses every message to a 512-bit value μ, at every security level, and only then hashes μ with the salt. Two messages with the same μ share every signing target, so a signature obtained on one transfers to the other. A generic collision on μ costs 2256 classically and about 2171 on a quantum computer.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| TSUOV-512 | 512 classical, 256 quantum | 2256 classical; ≈2171 quantum | Minor break |
| TSUOV-256 | 256 classical | 2256 (no margin) | Holds |
Evidence
The digest length is fixed in the specification and in the reference code alike.
Cause in the specification, traced to the specification text.
Limits
Generic and far from practical; fixed by lengthening μ at the higher levels. TSUOV-128 is unaffected.
What PQC-X adds
The quantum cost (about 2171, also below the 2256 quantum requirement of level 512) and the zero margin it leaves TSUOV-256.
Credit
First public report: M.-J. Saarinen (ngcc.dev sign-31-1, 2026-09-21). Found independently by PQC-X.