## 1 Introduction  
This research article evaluates the feasibility of cold boot attacks on the lifted unbalanced oil and vinegar (LUOV) scheme [1; 2], which is a variant of the UOV signature scheme [3]. The LUOV scheme is a member of the family of asymmetric cryptographic primitives based on multivariate polynomials over a finite field \(\mathbb{K}\) and has been submitted as candidate to the ongoing NIST standardisation process of post-quantum signature schemes [1]. We believe this to be the first time that this scheme is evaluated in this setting; however, there are recent studies evaluating other type of side channel attacks on other related signature schemes [4]. In the cold boot attack setting, an attacker may fetch any content from a machine's main memory after performing a cold-rebooting of the machine. However, this content will likely be perturbed due to physical effects on the main memory. That is, if the attacker obtains a content from memory, this content will likely be noisy, meaning that some 1 bits may have changed to 0 bits and vice versa. Thus, evaluating a public key cryptographic scheme in this setting means analysing the feasibility of an attacker, assumed to both have a noisy version of private key and know the probabilities associated with a 1 bit to changing to 0 and vice versa, to recover the original private key from the bit-flipped version of it. To this end, the attacker is needed to have knowledge about the in-memory private key representations of the scheme. This can be achieved by either proposing usual in-memory private key representations for the scheme or by reviewing specific implementations of the scheme to learn more about the actual formats used to store the scheme's private key. We adopt the second approach, and study the reference implementation and libpqcrypto implementation of this scheme, which both are written in \(C\) language. In addition, the reference implementation has been included in the package submitted to the NIST process. Our key recovery algorithm exploits the fact this signature scheme's private key is generated from a 256-bit seed. This allows us to reconstruct it from its noisy version by treating it as a combination of blocks of chunks, each of which has an assigned log-likelihood score obtained from combining candidate values for each of the chunks from their noisy versions. By making use of a general key recovery strategy developed in [5] as a core algorithm, we generate lists of high scoring candidates for each block and then generate complete candidates for the the 256-bit seed, which test to pinpoint the correct one. Our contribution is twofold: on the one hand, we present a key recovery algorithm for LUOV in the cold boot attack setting. This is in line with the current trend of devising, developing and implementing key recovery algorithms for different schemes, as is evinced by the literature discussed at length in Section 2.3. On the other hand, we further the research on the assessment of the most-important post-quantum candidates against this type of attack. In particular, this work is a small but significant part of the comprehensive assessment of schemes in the NIST selection process for post-quantum algorithms. This article is organised as follows. Section 2 discusses a background on cold boot attacks, including details on how this attack may be performed, the cold boot attack model we use in this article, the different approaches previously introduced to tackle the key recovery problem for quite a few cryptographic schemes in the cold boot setting and our approach to key recovery, which consists in splitting a byte representation of a private key component key into chunks, and then computing log-likelihood scores for each candidate value for each of the chunks. Section 3 describes LUOV, the reference implementation and the libpqcrypto implementation, mainly focusing on the key generation algorithm.