A team of researchers from Tohoku University and Kyoto University published a high-speed hardware accelerator design for QR-UOV today — a multivariate post-quantum digital signature scheme currently advancing through NIST's active third-round evaluation. The FPGA implementation achieves signing in 0.28 milliseconds and verification in 0.19 milliseconds at NIST security level I, with a lower lookup-table–time product than any existing UOV hardware design, according to the paper's performance results.

The paper, authored by Renma Sugai, Hiroshi Amagasa, Rei Ueno, and Naofumi Homma, landed in the IACR Cryptology ePrint Archive today as paper 2026/1458. What makes the timing significant: NIST's third round of its Additional Digital Signatures process is now live, and the agency's IR 8610 status report explicitly called for hardware acceleration benchmarks from submission teams as a factor in eventual standardization decisions.

Multivariate Cryptography and the 35-Year Quest for Practical Hardware

Post-quantum signature research has a concentration problem. NIST published its first three finalized quantum-resistant standards — ML-KEM, ML-DSA, and SLH-DSA (FIPS 203, 204, and 205) — in August 2024. Two of those three signature standards, ML-DSA and the forthcoming FN-DSA (based on FALCON), rest on the same mathematical family: lattice-based cryptography. If an attacker — or a researcher — ever found an efficient algorithm for solving structured lattice problems, two of NIST's three signature choices would fall simultaneously. That is why NIST launched a parallel track in 2022: the Additional Digital Signatures process, which seeks quantum-resistant schemes built on different mathematical foundations and advanced nine candidates to the third round on May 14, 2026.

QR-UOV sits in the multivariate family — the oldest and most durably secure branch of post-quantum cryptography. Its mathematical ancestor, the Unbalanced Oil and Vinegar scheme, was proposed in 1999 and has resisted cryptanalytic attack for over 25 years. That durability is meaningful. Rainbow, a UOV derivative and a NIST finalist in the main PQC process, was broken in 2022 when Ward Beullens recovered its private key over a weekend on a laptop. UOV's core structure survived that attack unscathed.

The "QR" in QR-UOV stands for quotient ring — the algebraic structure the Tohoku-led team introduced at ASIACRYPT 2021 to solve UOV's one persistent engineering weakness: its public keys were enormous. Plain UOV public keys can run to hundreds of kilobytes, making the scheme impractical for bandwidth-constrained systems. By representing the public key using block matrices whose components are polynomials in a quotient ring, the team achieved a roughly three-fold reduction in key size without meaningful loss in security or signature compactness. At NIST security level 3, QR-UOV achieves an 85.8 KB public key against the 252.3 KB of compressed Rainbow, as demonstrated in the original specification — a threshold that starts to look acceptable for some deployment contexts.

Why Signature Size Makes Multivariate Schemes Irreplaceable

Here is what the lattice-versus-multivariate comparison looks like in practice, and why it matters beyond standardization politics. ML-DSA-44 — the most compact of NIST's lattice-based signature options — produces signatures of approximately 2,420 bytes. UOV-family signatures, including QR-UOV, run to approximately 96 bytes, as documented in NIST IR 8610's parameter analysis. That is a 25-to-1 difference. Wikipedia's entry on multivariate cryptography describes this as the field's structural contribution: multivariate schemes provide the shortest signatures of any post-quantum algorithm family.

That gap matters wherever signature size is the binding constraint rather than signing speed. DNS Security Extensions (DNSSEC) records must fit within strict UDP payload limits. TLS certificate chains multiply signature sizes across each certificate in a chain. Firmware update packages for embedded systems and automotive controllers have hard size budgets. Code signing in firmware for constrained IoT devices cannot absorb a 25x signature expansion without architectural changes. A post-quantum ecosystem that relies entirely on lattice-based signatures will face real deployment friction in all of those contexts. A viable multivariate option changes that calculus.

QR-UOV also retains what Wikipedia identifies as UOV's hardware affinity: signature generation requires only additions and multiplications of small field elements — according to Wikipedia's description of the scheme, "fast and simple to implement even on constrained hardware." That property is what the Tohoku-Kyoto team's accelerator now validates in silicon.

A Systolic Array Built for Quotient Ring Arithmetic

The hardware design problem is more subtle than it might appear. Lattice-based schemes benefit from a decade of intensive hardware acceleration research centered on the Number Theoretic Transform — the lattice world's equivalent of a fast Fourier transform. The FPGA and ASIC community has developed mature NTT accelerator architectures, leaving lattice-based PQC hardware relatively well-served.

QR-UOV's quotient ring structure introduces a different set of computational demands: polynomial-matrix operations over the extension field F_{q^ℓ}, coefficient expansion for the Mersenne prime field F_q, and expansion of symmetric matrices generated in compressed form, as described in the paper's abstract. These are not operations that map onto existing NTT accelerator templates, and hardware-specific research on multivariate schemes has lagged well behind lattice-based work.

The Sugai et al. architecture addresses those demands in three interlocking ways.

First, a D×D systolic array accelerates polynomial-matrix multiplication over F_{q^ℓ}. In a systolic array, each processing element (PE) computes locally and passes results to its neighbors in a regular pipelined rhythm — the architecture suits dense matrix computations because data flows through the array rather than being fetched repeatedly from memory. Each PE in this design contains a polynomial multiply-accumulate unit tuned for extension-field arithmetic. The parallelization factor D is a design parameter that controls the trade-off between area and throughput.

Second, a quadratic-form operation unit handles signature verification without explicitly storing intermediate vector-matrix products. This is a memory-footprint optimization: the standard approach would require retaining large intermediate matrices in on-chip RAM, which is expensive in FPGA resources. The quadratic-form unit avoids that cost by computing the result progressively.

Third, and most architecturally distinctive, the design incorporates on-the-fly rejection sampling that exploits a structural property of AES-CTR mode: its output blocks can be generated independently, in any order. This independence allows the rejection sampling process — which generates pseudorandom field elements for key expansion — to proceed in parallel with dependent matrix operations rather than blocking them, maintaining a regular data supply without pipeline stalls.

These three elements combine with a pipelining stage that overlaps the i-th polynomial-matrix operation with the (i+1)-th public-key expansion, filling what would otherwise be idle cycles with productive work.

The result: key generation in 0.74 ms, signing in 0.28 ms, and verification in 0.19 ms at NIST security level I — with a lower LUT-time product than existing UOV hardware implementations.

Context: Third Round Is Now Taking Shape

QR-UOV is one of nine candidates NIST advanced on May 14, 2026, based on the evaluation documented in NIST Internal Report 8610. The other eight are FAEST, HAWK, MAYO, MQOM, SDitH, SNOVA, SQIsign, and UOV. Five candidates — CROSS, LESS, Mirath, PERK, and RYDE — were eliminated in the second round due to performance gaps or security vulnerabilities, according to the Quantum Computing Report's analysis of NIST IR 8610.

NIST's IR 8610 noted that QR-UOV largely avoided the "wedge attacks" — a class of algebraic attacks targeting characteristic-2 parameter sets — that affected other multivariate candidates during the second round. NIST IR 8610's evaluation criteria confirm that QR-UOV's use of odd-characteristic fields (specifically Mersenne prime fields like GF(31^3) and GF(127^3)) made it structurally resistant to those attacks. NIST explicitly cited QR-UOV's "substantial public-key reductions while preserving strong security margins" as factors in the advancement decision, as recorded in the IR 8610 report.

Third-round submission teams have until August 14, 2026 to submit specification updates and implementation modifications ("tweaks") in response to known vulnerabilities. The third round is expected to run approximately two years, with NIST planning a seventh PQC Standardization Conference in late spring or early summer 2027.

The hardware acceleration paper now appearing for QR-UOV is directly responsive to what NIST's third-round priorities ask for. NIST's IR 8610 evaluation criteria included hardware performance as an explicit consideration, and the agency has signaled that constrained-device deployment profiles matter for final standardization decisions. Two days after the QR-UOV hardware paper appeared, a concurrent paper by Krieger, Czuprynko, and Roy published a low-memory UOV hardware accelerator with side-channel defenses — a signal that the hardware implementation community is actively responding to the third-round timeline across multiple UOV-family candidates.

Tohoku's Hardware Cryptography Lineage

The research team's choice of problem reflects a sustained strategic focus at Tohoku's Research Institute of Electrical Communication. Naofumi Homma's laboratory has previously published hardware designs for CRYSTALS-Kyber's NTT accelerator and a high-speed post-quantum Diffie-Hellman architecture. The group has also contributed to side-channel analysis methodology for post-quantum implementations, including fault-injection attack analysis across NIST Round 3 KEM candidates. That combination — offensive security analysis informing defensive hardware design — is reflected in the QR-UOV accelerator's architectural choices, including the on-the-fly rejection sampling that avoids regular-access patterns exploitable in side-channel attacks.

Rei Ueno, now at Kyoto University, brings a parallel track record in QR-UOV specifically. The same team published an AVX2 software optimization for QR-UOV in the IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES 2026) earlier this year, achieving 5.1x key generation improvement, 3.6x signing improvement, and 5.7x verification improvement over the reference implementation at security level I. Today's FPGA paper represents the hardware counterpart to that software work — the same team now building the silicon pathway for the same algorithm.

What Practical Implications Extend Beyond the Competition

Even in the best case, final NIST standardization decisions from the third round are years away — the process is expected to conclude roughly in the 2028–2030 window. But hardware implementation research produces value independent of which algorithm NIST ultimately selects.

Organizations planning post-quantum cryptographic migrations need to evaluate which algorithms can actually be deployed in their specific hardware environments. A scheme that performs well on general-purpose processors but requires prohibitive silicon area or power consumption will not reach production security products regardless of its mathematical properties. The FPGA timing figures from today's paper — 0.28 ms signing, 0.19 ms verification at security level I — give hardware security engineers their first concrete data point for QR-UOV embedded deployment planning.

There is also a reusable-knowledge argument. The systolic array architecture for polynomial-matrix multiplication over extension fields, the memory-efficient quadratic-form verification unit, and the on-the-fly AES-CTR rejection sampling — these are architectural contributions to the broader post-quantum hardware design community. Whether QR-UOV or a different multivariate scheme earns NIST's eventual standard, engineers working on multivariate-family hardware will build on this work. And given that multivariate schemes offer the only realistic pathway to sub-100-byte post-quantum signatures, that community has a significant deployment problem worth solving.

Federal migration deadlines reinforce the urgency. NSA's CNSA 2.0 directive requires post-quantum cryptography for new national security systems starting in 2027. A June 2026 executive order sets 2030 and 2031 compliance deadlines for federal civilian high-value systems. Organizations building hardware security products for those markets cannot wait for NIST's final list — they need hardware benchmarks for the candidates under active evaluation now.

Frequently Asked Questions

What makes QR-UOV different from the lattice-based post-quantum signature schemes NIST has already standardized?

QR-UOV belongs to the multivariate polynomial family, which rests on a completely different mathematical problem than lattice-based schemes like ML-DSA (CRYSTALS-Dilithium). Lattice schemes' security depends on the hardness of problems like Module Learning With Errors; multivariate schemes depend on the hardness of solving systems of quadratic equations over finite fields, which is NP-complete and has no known efficient quantum algorithm. The practical consequence is signature size: QR-UOV produces signatures of approximately 96 bytes, compared to roughly 2,420 bytes for ML-DSA-44. For applications where signature size is the binding constraint — DNSSEC, embedded firmware updates, code signing in constrained devices, TLS certificate chains — that 25-to-1 difference is architecturally significant and cannot be resolved through lattice-based alternatives alone.

Why does a hardware accelerator paper matter for NIST's standardization process?

NIST's evaluation criteria for its Additional Digital Signatures process explicitly include hardware performance and constrained-device deployment feasibility. An algorithm with strong security properties and good software benchmarks can still fail to reach standardization if it cannot be implemented efficiently in the field-programmable gate arrays and application-specific integrated circuits used in hardware roots of trust, smart cards, automotive controllers, and network security chips. Until today's paper, QR-UOV had no published FPGA or ASIC implementation data — meaning NIST's evaluators and organizations planning deployments had no way to assess whether it could function in hardware-constrained environments. The paper provides that data for the first time, directly addressing what IR 8610 identified as a gap for the third-round evaluation phase.

How does QR-UOV's hardware performance compare to lattice-based alternatives?

The paper reports key generation in 0.74 ms, signing in 0.28 ms, and verification in 0.19 ms at NIST security level I, with a lower LUT-time product than previous UOV hardware designs. Comparable lattice-based figures for similar security levels on FPGA vary by implementation, but Dilithium-II (NIST level 2) FPGA implementations have been reported at approximately 117 microseconds for signing — suggesting the latency profiles are broadly in the same range, though direct comparison requires identical FPGA platforms and security levels. The more meaningful comparison for practitioners is the full deployment picture: QR-UOV's sub-100-byte signatures and multi-kilobyte public keys (85.8 KB at level 3) trade off differently against ML-DSA's much larger signatures (2,420 bytes) and smaller key structures depending on the specific use case's bandwidth and storage profile.

What happens next for QR-UOV in the NIST process?

Submission teams have until August 14, 2026 to deliver specification tweaks addressing any known vulnerabilities identified during the second round. After that, the third-round evaluation phase — expected to run approximately two years — involves continued public cryptanalysis, hardware and software benchmarking, and formal security analysis. NIST plans a seventh PQC Standardization Conference in late spring or early summer 2027 where teams will present updates. Standardization decisions from the third round are anticipated roughly in the 2028–2030 window. The hardware accelerator paper published today positions QR-UOV with concrete FPGA data for those evaluation activities, alongside the AVX2 software acceleration results the same team published in TCHES 2026 earlier this year.