Short answer: UOV, short for Unbalanced Oil and Vinegar, is a multivariate digital signature scheme first proposed in 1999 by Aviad Kipnis, Jacques Patarin and Louis Goubin. Its designers state that it remains secure even against quantum computers, that it has small signatures and fast signing, and that its main drawback is a large public key. These are the submission team's own claims, and the scheme is a candidate in NIST's additional signature process, not a standard.
What UOV is
The UOV designers' website describes UOV as a digital signature scheme built from trapdoored multivariate quadratic maps, following the hash-and-sign paradigm. It says UOV can be seen as the unbalanced version of the original Oil and Vinegar (OV) scheme by Jacques Patarin. The designers' Round-2 submission document says that in a multivariate public key cryptosystem, the key pair is composed of multivariate polynomials, and the hardness is firmly connected to the hardness of solving a system of multivariate equations. It notes that such systems date back to the 1980s, and that two multivariate signature schemes, Rainbow and GeMSS, made it into the third round of the NIST PQC competition.
Status in NIST's process
According to the designers' site, UOV was submitted in response to NIST's call for additional digital signature schemes for the post-quantum standardization process. It says UOV was selected in October 2024 as one of the Round-2 candidates, and that the Round-2 submission package was submitted in February 2025. This is the designers' account as of that submission, and readers should check NIST's current project pages for the present status. Being a candidate does not make UOV a standard.
What the designers claim about performance
The submission document says UOV has withstood more than twenty years of cryptanalysis since 1999, and that it excels in time efficiency and signature size. It claims that, at NIST security level 1, UOV outshines Dilithium, Falcon and SPHINCS+ in those respects. The document then says UOV is competitive with the new NIST standards by most measures except public key size: for level 1, the classic version has a public key of 272 KB, which it calls significantly larger than those of Dilithium, Falcon and SPHINCS+. Treat these comparisons as the submitters' claims, since they are not an independent evaluation.
Variants with smaller keys
To address the key size, the designers propose three variants, called classic, pkc and pkc+skc, to accommodate different space and time needs. They say new versions with smaller keys, for example 43 KB at NIST security level 1, come at the cost of verification speed.
Changes in the Round-2 design
The designers say that in the earlier submission both the public key seed and the secret key seed were drawn uniformly and independently. In the Round-2 design, the public key seed is derived pseudo-randomly from the secret key seed, and the key expansion procedure outputs both the trapdoor matrix and the public key seed. They say this reduces the size of the compressed secret key by 16 bytes, from 48 bytes to 32 bytes.
What this does not tell you
This article summarises the designers' own pages and submission document. It includes no independent cryptanalysis, and it makes no claim about deployment. Anyone assessing UOV should read current independent cryptanalysis, not only the designers' account.
FAQ
What does UOV stand for?
Unbalanced Oil and Vinegar, the unbalanced version of Patarin's original Oil and Vinegar scheme.
Is UOV a NIST standard?
No. The designers say it was selected in October 2024 as a Round-2 candidate in NIST's additional signature process.
What is its main drawback according to the designers?
Public key size: the classic version at security level 1 has a public key of 272 KB.
Are there smaller-key versions?
Yes. The designers propose variants with keys as small as 43 KB at level 1, at the cost of verification speed.
Who says it is faster than the NIST standards?
The designers, in their own submission document. It is not an independent benchmark.
All field notes