Universal forgery attack breaks Chinese PQC signature Origami using only the public key
matthew_d_green · x · 2026-10-16
Cryptographer mjoscrypto notes he has become the de facto CVE authority for Chinese post-quantum schemes via his tracker. The underlying ePrint paper shows Origami, a multivariate signature scheme submitted to NGCC round-1, is a Rainbow-type construction whose central map is exposed: the public key yields an equivalent secret key, enabling forgery in 0.01s at Origami-128. The attack works on all four parameter sets against the unmodified reference implementation and refutes the security proof's inversion assumption. Disclosed to designers Sept 22, made public on NIST pqc-forum Sept 24; designers acknowledged the forgery and promised an updated algorithm.
More from Safety
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16
- Vitalik builds "paranoid mode" agent wrapper with Tor, zkAPI and local prompt rewriting — DavideCrapis · 2026-10-16
- Security team demos Signal 1-click exploit technique at Hexacon Paris — moyix · 2026-10-16
- China moves to impose registration and licensing on frontier AI model weights and chip designs — deanwball · 2026-10-16
- Same agent task, two auth models: shared admin login wipes 1M audit rows, per-agent identity gets refused — Prompt Engineering · 2026-10-16
- Binding agent approvals to exact content: a synthetic test for stale permissions — Crescitaly · 2026-10-16