Algorithm

XMSS

Family: hash-based.

XMSS signs messages with one-time keys that are organized under a single Merkle tree root, so one short public key covers many signatures. Each one-time key may be used once only, so the signer must record how many it has used. Signatures are small for a hash-based scheme. RFC 8391 specifies it, and NIST approves it for stateful use.

Safety: High

Why this rating

Security rests only on the properties of the hash function. The scheme is stateful: signing twice with the same one-time key reveals enough of that key's secrets for an attacker to forge signatures. A restored backup, a cloned device, or a crash before state is saved can cause this, so safe use needs strict state management.

Standard

https://www.rfc-editor.org/info/rfc8391

Research

• XMSS: A Practical Forward Secure Signature Scheme Based on Minimal Security Assumptions (2011)
• RFC 8391: XMSS: eXtended Merkle Signature Scheme
• NIST SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes

Implemented by

• liboqs