Full-Key Recovery and Forgery from One MQOM v2.1 Signature
We give a full-key-recovery attack on MQOM v2.1, a Round-3 candidate in the NIST additional-signature process, that recovers the complete signing key from one accepted signature and uses it to sign a fresh message. If $\delta=\operatorname{FirstBits}_{\lambda}(x)$ is the prefix of the witness $x$, the sibling path dete...