VWZ Cryptanalysis Challenge

Public bounty for breaking the Vandermonde-Wronskian-Zariski tensor trapdoor

What is VWZ?

VWZ is a post-quantum signature scheme (ePrint 2025/624, Narayanan / SandboxAQ) based on a novel hardness assumption: the pseudorandomness of Vandermonde exponential-product tensors under basis twist. Unlike lattice-based (ML-DSA) or hash-based (SLH-DSA) signatures, VWZ derives its security from the difficulty of distinguishing specially structured tensors from truly random ones.

C implementation: 43/43 tests PASS
Cross-verified: Python ↔ C
KeyGen: 7.1 µs | Sign: 2.3 µs | Verify: 0.6 µs

Parameters Under Challenge

Level 1 — Small
k=4
q=65537 | 40B sig | 900B pk
Level 2 — Medium
k=8
q=65537 | 72B sig | 5.8KB pk
Level 3 — Large
k=16
q=65537 | 136B sig | 44KB pk
Level 4 — Production
k=4
q≈2⁶⁴ | 160B sig | 3.5KB pk

Attack Targets

#TargetPrize TierStatus
1 Key Recovery — Recover φ or X from Tpub only 🏆 Tier 1 OPEN
2 Universal Forgery — Sign arbitrary messages given Tpub 🏆 Tier 1 OPEN
3 Existential Forgery — Produce one valid (m, σ) pair not in training set 🥈 Tier 2 OPEN
4 Algebraic Attack — Solve fT(w₂,w₃)=t for specific (T, t) 🥈 Tier 2 OPEN
5 Distinguisher — Distinguish VWZ orbit from random tensor (advantage > 2⁻³⁰) 🥉 Tier 3 OPEN

How to Participate

1
Download Challenge Dataset

Each dataset contains: a public key Tpub (JSON), 100 valid (message, signature) pairs for training, and verification scripts (Python + C).

vwz-challenge-k4.zip (k=4, q=65537) — 60 KB
2
Develop Your Attack

Use any technique: linear algebra, Gröbner bases, lattice reduction, SAT solvers, ML, or novel methods. All approaches are welcome.

3
Submit via GitHub or Email

Send your solution (code + writeup) as a GitHub PR or email to research@fibemate.net with subject "VWZ Challenge Submission".

4
Verification

All submissions are verified automatically against the reference C implementation. Successful attacks are reviewed manually and posted to the leaderboard within 48 hours.

Leaderboard

RankResearcher / TeamTargetParametersMethodDate
No successful attacks reported yet. Be the first.

Known Attack Analysis

We have pre-analyzed the following attack frameworks against VWZ. Successful challenges should either implement one of these more efficiently than estimated, or introduce a novel approach.

AttackComplexityStatusReference
Hull Slice-Rank Õ(qk/2) — k=4→2³², k=8→2⁶⁴ Rank-1 exposed; recovery still expensive ePrint 2025/596
Triangular TI ~1/q per trial → infeasible for q≥2⁶⁴ Not a threat ePrint 2024/1396
Gröbner Basis (F4) k=3: seconds / k=4: >7h (did not finish) Approaches viability at k=4 SageMath 10.4 experiment
Existential Forgery P ≈ C(2k+1,k+1)/qk → 257 for k=4,q=65537 ~57 bits; infeasible for q≥2⁶⁴ Hamming sphere bound

Resources

FIBEMATE Research Lab · fibemate.net · Challenge launched 2026-07-17