TLDR

• SNOVA is a UOV-style signature scheme that tries to reduce public key size by using a noncommutative matrix-ring structure.
• The main criticism from the cryptanalysis paper is that the original SNOVA proposal analyzed the scheme as a larger, harder UOV system than it actually is. Known structural attacks are cheaper than originally claimed, and some proposed parameter sets don't achieve their advertised security levels.
• SNOVA, at least in its original form, isn't mature enough for production use.
• The paper also suggests that the same structural criticism applies to NOVA, although its detailed analysis focuses on SNOVA.

Table of Contents

• 1. Oil-and-Vinegar signatures
  • 1.1. How scheme works
  • 1.2. Security of UOV schemes
  • 1.3. Weakness
• 2. NOVA and SNOVA
  • 2.1. NOVA
  • 2.2. SNOVA
• 3. SNOVA cryptanalysis
• 4. References

1. Oil-and-Vinegar signatures

The Oil-and-Vinegar (OV) signature scheme is a multivariate signature scheme. Its public key is a set of quadratic equations over a finite field.

OV splits the variables into two groups:

• vinegar variables
• oil variables

The equations follow a fixed pattern: