Public bounty for breaking the Vandermonde-Wronskian-Zariski tensor trapdoor
VWZ is a post-quantum signature scheme (ePrint 2025/624, Narayanan / SandboxAQ) based on a novel hardness assumption: the pseudorandomness of Vandermonde exponential-product tensors under basis twist. Unlike lattice-based (ML-DSA) or hash-based (SLH-DSA) signatures, VWZ derives its security from the difficulty of distinguishing specially structured tensors from truly random ones.
| # | Target | Prize Tier | Status |
|---|---|---|---|
| 1 | Key Recovery — Recover φ or X from Tpub only | 🏆 Tier 1 | OPEN |
| 2 | Universal Forgery — Sign arbitrary messages given Tpub | 🏆 Tier 1 | OPEN |
| 3 | Existential Forgery — Produce one valid (m, σ) pair not in training set | 🥈 Tier 2 | OPEN |
| 4 | Algebraic Attack — Solve fT(w₂,w₃)=t for specific (T, t) | 🥈 Tier 2 | OPEN |
| 5 | Distinguisher — Distinguish VWZ orbit from random tensor (advantage > 2⁻³⁰) | 🥉 Tier 3 | OPEN |
Each dataset contains: a public key Tpub (JSON), 100 valid (message, signature) pairs for training, and verification scripts (Python + C).
vwz-challenge-k4.zip (k=4, q=65537) — 60 KB
Use any technique: linear algebra, Gröbner bases, lattice reduction, SAT solvers, ML, or novel methods. All approaches are welcome.
Send your solution (code + writeup) as a GitHub PR or email to research@fibemate.net with subject "VWZ Challenge Submission".
All submissions are verified automatically against the reference C implementation. Successful attacks are reviewed manually and posted to the leaderboard within 48 hours.
| Rank | Researcher / Team | Target | Parameters | Method | Date |
|---|---|---|---|---|---|
| No successful attacks reported yet. Be the first. | |||||
We have pre-analyzed the following attack frameworks against VWZ. Successful challenges should either implement one of these more efficiently than estimated, or introduce a novel approach.
| Attack | Complexity | Status | Reference |
|---|---|---|---|
| Hull Slice-Rank | Õ(qk/2) — k=4→2³², k=8→2⁶⁴ | Rank-1 exposed; recovery still expensive | ePrint 2025/596 |
| Triangular TI | ~1/q per trial → infeasible for q≥2⁶⁴ | Not a threat | ePrint 2024/1396 |
| Gröbner Basis (F4) | k=3: seconds / k=4: >7h (did not finish) | Approaches viability at k=4 | SageMath 10.4 experiment |
| Existential Forgery | P ≈ C(2k+1,k+1)/qk → 257 for k=4,q=65537 | ~57 bits; infeasible for q≥2⁶⁴ | Hamming sphere bound |
FIBEMATE Research Lab · fibemate.net · Challenge launched 2026-07-17