Algorithm

LMS

Family: hash-based.

LMS, with its multi-level form HSS, is a signature scheme built from hash functions and a Merkle tree of one-time keys. A single public key covers a limit on the signature count that is set when the key is generated. The signer must remember which one-time keys it has already used. RFC 8554 defines it, and NIST approves it for uses such as signing firmware.

Safety: High

Why this rating

Security rests only on the properties of the hash function. The scheme is stateful: using one one-time key for two messages can reveal enough secret material to forge signatures. Backup restores, cloned devices, and failed state writes are the main dangers, so key storage must be handled with great care.

Standard

https://www.rfc-editor.org/info/rfc8554

Research

• RFC 8554: Leighton-Micali Hash-Based Signatures
• NIST SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes

Implemented by

• liboqs