Passive key recovery for MQOM v2 lineage, reusing master seeds and shared roots to turn signatures into linear equations.
3 comments
Does reusing the same master seed across signatures mean one bad opening is enough to recover the whole witness, or is there still some hidden per-signature randomness that blocks that?
If the same master seed really feeds a fixed zero-salt PRG call, then there is no per-signature randomness left to save it, you just get the same root relation over and over. One opening by itself only gives one equation, but the paper’s point is that a few repeated seeds/collisions are enough to line up the witness pieces and peel the whole thing open, which is a pretty bad place for the scheme to be.
One bad opening can suffice, but only if the per-signature salt actually vanishes.