Short answer: Research papers propose hash-based signature (HBS) schemes for firmware signing and secure boot, because they rest on well-understood hash functions rather than structured lattices. A 2024 paper presents a hardware/software co-design supporting the stateful LMS and XMSS schemes and the stateless SPHINCS+ scheme, and a 2021 paper reports that post-quantum signatures with under one second signing and under 10 milliseconds verification would have no material impact on UEFI secure boot. These are research results, and the authors note that real-world adoption of post-quantum cryptography is slow.
Why hash-based signatures for firmware
The 2024 paper says secure boot of embedded devices is a scenario where the slow adoption of post-quantum cryptography (PQC) can cause fundamental security problems, largely because of concerns about practicability and maturity. It describes HBS schemes as standing out for their straightforward security proofs and as being on the fast track to standardisation. The 2021 paper adds that LMS and SPHINCS+ are based on quantum-secure, proven primitives, which it calls more well-trusted than primitives relying on additional hardness assumptions. Firmware often has a long lifecycle, and the 2021 authors take that into account in their design.
Stateful and stateless schemes
The 2024 authors exploit the performance-intensive similarities of the stateful LMS and XMSS schemes and the stateless SPHINCS+ scheme. They say this lets designers use a stateful or stateless scheme depending on the constraints of each application. Stateful schemes need the signer to track state, so they suit settings where signing can be controlled. The papers do not claim either type fits every product.
Performance on small and secure-boot hardware
A comparison of LMS and XMSS on an ARM Cortex-M4 describes stateful hash-based schemes as among the most efficient approaches for post-quantum signatures. The authors add that they are not suitable for general use but may suit some use cases on constrained devices. They compared performance, stack consumption and other figures for key generation, signing and verifying, using optimised implementations of SHA-256, SHAKE256, Gimli-Hash and variants of KECCAK. They report slightly optimised XMSS implementations with speedups of up to 3.11x for key generation, 3.11x for signing and 4.32x for verifying.
For UEFI secure boot, the 2021 paper reports that post-quantum signatures with less than one second signing and less than 10 milliseconds verification would have less than a one per mille impact on secure boot. It proposes new parameter sets for software signing use cases at two post-quantum security levels. The authors evaluate signing in hardware, virtual secure boot and FPGAs against classical RSA, and conclude that trusted post-quantum signatures are possible with an immaterial impact on the verifier and an acceptable impact on the signer.
Standards context
SPHINCS+ has been standardised as SLH-DSA in FIPS 205, approved in August 2024. Stateful LMS and XMSS are specified separately. The papers cited here predate or describe the standardisation process and use the scheme names LMS, XMSS and SPHINCS+.
Limits
These are academic evaluations on specific processors and parameter sets. They do not show that any particular product has adopted these schemes.
FAQ
Why use hash-based signatures for firmware?
The papers cite straightforward security proofs and well-trusted primitives, plus suitability for long-lived embedded devices.
What is the difference between stateful and stateless schemes?
Stateful schemes such as LMS and XMSS require the signer to manage state. Stateless schemes such as SPHINCS+ do not.
Do they fit small microcontrollers?
One study compared LMS and XMSS on an ARM Cortex-M4 and calls stateful schemes among the most efficient post-quantum signatures, though not for general use.
What does it cost secure boot?
A 2021 paper reports that under one second signing and under 10 ms verification would not materially affect UEFI secure boot.
Are these in products today?
The papers say adoption of PQC in real-world products is slow. They report research implementations.
All field notes