Hash-based signatures - stateful and stateless designs

Short answer: Hash-based signatures build digital signatures from hash functions rather than number-theoretic problems, which makes them a candidate for post-quantum security. The main design split is between stateful schemes, which must track which one-time keys have been used, and stateless schemes such as SPHINCS+, which avoid that burden at a cost. Research papers from 2016, 2024 and 2025 cover state management risks, a hardware design that supports both kinds, and attacks to watch for. These are research findings, and nothing here describes a particular deployed product.

Why hash-based signatures

A 2025 ePrint review says quantum computing threatens the security assumptions behind classical public-key algorithms such as RSA and ECC, and that hash-based signatures stand out as a compelling alternative because they rely on well-understood hash functions rather than number-theoretic hardness assumptions. The review covers Lamport, WOTS, XMSS, XMSS-MT and SPHINCS+, looking at design, key generation, signing and verification, and at how Merkle trees and address structures are used in practice. A 2024 paper in the Journal of Cryptographic Engineering says these schemes stand out for their straightforward security proofs. A 2016 paper calls them well understood and promising candidates, and the object of standardisation efforts.

The statefulness concern

The 2016 paper says the most commonly raised concern in standardisation is statefulness, which comes from using one-time signature schemes. While the theory is mature, it says the system security issues of managing that state had not been discussed. The authors analyse state management in N-time hash-based schemes for both security and performance and categorise the problems that arise from state synchronisation failures. They describe a state reservation approach that loosens the coupling between volatile and nonvolatile storage, and show it fits naturally in a hierarchical scheme.

To protect against unintentional copying of the private key state, they consider a hybrid stateless and stateful scheme. It gives graceful security degradation if the state is copied, at the cost of larger signatures, and compared with a fully stateless scheme it keeps the main benefits with smaller signatures and faster signing.

Supporting both kinds in hardware

The 2024 paper looks at secure boot on embedded devices, noting that adoption of post-quantum cryptography in real products is slow because of concerns about practicability and maturity. The authors present a hardware and software co-design for hash-based schemes. They exploit the performance-intensive similarities of the stateful LMS and XMSS schemes and the stateless SPHINCS+ scheme, so designers can choose a stateful or stateless scheme to fit the constraints of each application. They compare against hardware-accelerated classical asymmetric algorithms, outline the use of different schemes in the boot process, show that parameter choices matter, and report performance gains with different levels of hardware acceleration.

Attacks to consider

The 2025 review also analyses attacks on these constructions, including intermediate value guessing, Antonov's attack, multi-target attacks and fault injection. It concludes by discussing both strengths and vulnerabilities, and describes hash-based signatures as viable secure and efficient post-quantum candidates.

What this does not tell you

These papers compare designs and implementations in research settings. They do not say which scheme a given organisation should choose, and the best choice depends on constraints such as signature size, signing speed and how safely state can be managed.

FAQ

What makes a signature scheme hash-based?

Its security rests on hash functions, not on factoring or discrete logarithms.

What is the stateful concern?

Stateful schemes use one-time keys and must never reuse one, so state errors can break security.

How does SPHINCS+ differ?

It is stateless, so there is no state to track.

Is there a middle option?

A 2016 paper describes a hybrid scheme that degrades gracefully if the key state is copied, with larger signatures.

Are these schemes attack-free?

No. The 2025 review lists attacks such as multi-target attacks and fault injection.