Public cryptanalysis challenge for the FIBEMATE VWZ (Vandermonde-Wang-Zhang) rank-2 signature — based on Narayanan 2025/624 (retracted 2026-08-19)
VWZ (Vandermonde-Wang-Zhang) is FIBEMATE's independently named post-quantum signature scheme. Its trapdoor reuses the Vandermonde-Weyman-Zelevinsky (VWZ) tensor construction introduced by Narayanan in ePrint 2025/624 ("Trapdoor one-way functions from tensors"). Note the shared "VWZ" abbreviation: FIBEMATE's Wang-Zhang naming is distinct from the paper's Weyman-Zelevinsky attribution.
Honesty note: the original 2025/624 construction was retracted by its author on 2026-08-19 — its rank-1 three-dimensional tensors are efficiently distinguishable from random (rank-deficient 2D slices). That is exactly the weakness exploited by the rank-1 total break documented in our security assessment (36/36 forgeries accepted). This challenge does not offer the original rank-1 scheme; it offers FIBEMATE's rank-2 hardening variant, which closes the rank-1 distinguisher.
The rank-2 variant's security is only partially verified at the algebraic-attack layer (rank-1 attacks score 0/27†; 44/44 boundary tests pass†). There is no third-party audit and no formal reduction to a standard assumption. Treat all security claims as experimental. VWZ is not on any production code path.
docs/fibemate-vwz-specification_20260906.md, rank-2, q=3329, branch
experimental/vwz-lg) used by the Rust/WASM reference build. The challenge runs on its own q=65537 field and is
verified by datasets/verify.py (q=65537) without needing the q=3329 reference build. Note: the
44/44 boundary tests and 0/27 rank-1 attacks cited above were measured on the q=3329 reference
construction; the q=65537 challenge field is a separate parameterization of the same rank-2 VWZ scheme.
| # | Target | Prize Tier | Status |
|---|---|---|---|
| 1 | Key Recovery — Recover φ or X from Tpub only | 🏆 Tier 1 | OPEN |
| 2 | Universal Forgery — Sign arbitrary messages given Tpub | 🏆 Tier 1 | OPEN |
| 3 | Existential Forgery — Produce one valid (m, σ) pair not in training set | 🥈 Tier 2 | OPEN |
| 4 | Algebraic Attack — Solve fT(w₂,w₃)=t for specific (T, t) | 🥈 Tier 2 | OPEN |
| 5 | Distinguisher — Distinguish VWZ orbit from random tensor (advantage > 2⁻³⁰) | 🥉 Tier 3 | OPEN |
Each dataset contains: a public key Tpub (JSON), 100 valid (message, signature) pairs for training, and verification scripts (Python + C).
vwz-challenge-k4.zip (k=4, q=65537) — 60 KB
Datasets for k=8 (Level 2) and k=16 (Level 3) are pending; only the k=4 dataset is published. A Python verifier (datasets/verify.py, q=65537) and a C verifier (datasets/verify.c, q=65537, byte-for-byte equivalent to verify.py) are provided. The k=8/k=16 dataset generators are not tracked in any repository or branch and remain pending recovery or reimplementation.
Use any technique: linear algebra, Gröbner bases, lattice reduction, SAT solvers, ML, or novel methods. All approaches are welcome.
Send your solution (code + writeup) as a GitHub PR or email to research@fibemate.net with subject "VWZ Challenge Submission".
All submissions are verified automatically against the reference Rust/WASM implementation. Successful attacks are reviewed manually and posted to the leaderboard within 48 hours.
| Rank | Researcher / Team | Target | Parameters | Method | Date |
|---|---|---|---|---|---|
| No successful attacks reported yet. Be the first. | |||||
We have pre-analyzed the following attack frameworks against VWZ. Successful challenges should either implement one of these more efficiently than estimated, or introduce a novel approach.
| Attack | Complexity | Status | Reference |
|---|---|---|---|
| Hull Slice-Rank | Õ(qk/2) — k=4→2³², k=8→2⁶⁴ | Rank-1 exposed; recovery still expensive | ePrint 2025/596 |
| Triangular TI | ~1/q per trial → infeasible for q≥2⁶⁴ | Not a threat | ePrint 2024/1396 |
| Gröbner Basis (F4) | k=3: seconds / k=4: >7h (did not finish) | Approaches viability at k=4 | SageMath 10.4 experiment artifact pending |
| Existential Forgery | P ≈ C(2k+1,k+1)/qk → 257 for k=4,q=65537 | ~57 bits; infeasible for q≥2⁶⁴ | Hamming sphere bound |
† 44/44 boundary tests and 0/27 rank-1 attacks refer to the rank-2 boundary-format verification in the experimental/vwz-lg attack suite (see VWZ 研究线概览, 2026-09-06). Gröbner timing is a SageMath 10.4 experiment; the run artifact (script + log) is pending publication.
FIBEMATE Research Lab · fibemate.net · Challenge launched 2026-07-17