SNOVAS

SNOVA

SNOVA is a digital signature algorithm that was selected for Round 3 of the NIST Post-Quantum Cryptography Project. The current version is dated August 2026.

About

SNOVA is a variant of the Unbalanced Oil and Vinegar (UOV) signature scheme designed to operate over noncommutative rings for enhanced efficiency and reduced public key size. While traditional UOV schemes suffer from excessively large public keys, SNOVA addresses this by utilizing a key-randomness alignment technique that successfully adapts to noncommutative rings without being negatively affected by their noncommutativity.

In response to cryptanalysis during the Round 1 and Round 2 evaluations, the SNOVA scheme has been reformulated for the Round 3 submission to provide a more flexible framework. Recent research shows that SNOVA can be characterized as applying a whipping transformation, similar to that of MAYO, to a structured UOV public key utilizing the F_q[S] structure. Because the ring F_q[S] is isomorphic to the extension field F_(q^l), this design is comparable to the polynomial matrix technique utilized in QR-UOV.

The Round 3 reformulation extends the signature to accommodate rectangular matrices, yielding a scheme defined by seven parameters: (v, o, q, l, r, m_1, m_2). This allows the whipping dimension r to be an independent parameter distinct from l, and the number of equations m_2 to be chosen independently from the number of public key matrices m_1. This reformulation offers advantages in security and much greater flexibility in parameter selection, while remaining fully backward compatible with the Round 2 version.

Advantages

  • As a MQ-based signature scheme, SNOVA retains the characteristically short signatures of multivariate constructions while substantially mitigating the large-public-key problem encountered in traditional MQ schemes. SNOVA offers smaller public key and signature sizes than Falcon at all security levels.
  • Modest computational requirements and fast verification. Signing and verification are implemented using relatively simple matrix and finite-field operations. These operations can be efficiently accelerated on modern processors using instruction sets such as AVX2 and GFNI.
  • High parameter flexibility and a wide security margin. The Round 3 SNOVA supports rectangular signatures. The resulting framework is described by seven parameters: (v,o,q,l,r,m_1,m_2). These parameters provide considerable flexibility for balancing public-key size, signature size, computational performance, and resistance to known attacks. It also enables the selection of conservative parameter sets with security margins substantially exceeding the minimum requirements of their target NIST security levels.
  • Although SNOVA is conceptually constructed using noncommutative matrix rings, its concrete operations consist primarily of standard finite-field linear algebra. Our SageMath version recreates the official SNOVA KAT files using less than 600 lines of source code. SNOVA may be viewed as a UOV-type construction augmented by carefully designed noncommutative matrix structure. Consequently, the scheme remains conceptually accessible and amenable to detailed algebraic and implementation-level analysis.

Performance

The following table presents the performance of the proposed SNOVA instances. Sizes are in bytes and performance is in cycles, measured on a modern desktop system supporting AVX2 and GFNI (Intel Core Ultra 7 265K).

SL I

VariantpksksigKeyGenSignVerify
SNOVA_I_K37696528159,618584,188166,666
SNOVA_I_K_AES3769652887,169512,00494,164
SNOVA_I_B65696388170,468557,746141,919
SNOVA_I_B_AES65696388102,661489,98374,376
SNOVA_I_S101696272204,195397,921149,024
SNOVA_I_S_AES101696272132,758325,41878,305

SL III

VariantpksksigKeyGenSignVerify
SNOVA_III_K91296688416,4901,240,034349,462
SNOVA_III_K_AES91296688243,3111,061,262175,688
SNOVA_III_B141696532484,6261,226,638335,912
SNOVA_III_B_AES141696532303,6221,045,116156,118
SNOVA_III_S203296456562,0691,333,170356,953
SNOVA_III_S_AES203296456372,1651,141,612167,684

SL V

VariantpksksigKeyGenSignVerify
SNOVA_V_K121696896811,6802,573,021684,735
SNOVA_V_K_AES121696896548,9982,301,728424,527
SNOVA_V_B189196691955,4442,470,611679,221
SNOVA_V_B_AES189196691682,8232,192,284409,444
SNOVA_V_S2716965911,101,9532,619,986749,582
SNOVA_V_S_AES271696591823,1542,341,503465,939

Resources

Team

Submitter

  • Lih-Chung Wang

Team members (in alphabetical order)

  • Chun-Yen Chou
  • Jintai Ding
  • Hao Guo
  • Yen-Liang Kuan
  • Jan Adriaan Leegwater
  • Ming-Siou Li
  • Peigen Li
  • Bo-Shu Tseng
  • Po-En Tseng
  • Chia-Chun Wang

Contact