Skip to content
—
QuantascanAlpha

Hash-based signatures

The family of signatures that build security from hash functions alone — the foundation under XMSS.

5 min readUpdated 2026-06-20

On this page▾

XMSS, the signature behind QRL Legacy, belongs to a broader family called hash-based signatures. Understanding the family explains why QRL trusted this approach years before lattice cryptography was standardised.

Security from hashing alone

Most signatures derive their security from a "hard" math problem — factoring big numbers (RSA) or the elliptic-curve discrete log (ECDSA). Those problems are exactly what Shor's algorithm solves, which is what makes them quantum-vulnerable.

Hash-based signatures take a different foundation entirely. Their security rests only on the properties of a hash function — that it's hard to reverse (preimage resistance) and hard to find collisions. There's no number theory involved, so there's nothing for Shor's algorithm to attack. The only quantum tool that touches hashes is Grover's algorithm, and its modest speed-up is easily offset with larger hash outputs.

The most conservative post-quantum choice

Cryptographers often call hash-based signatures the most conservative post-quantum option. The reason is trust:

  • Hash functions like SHA-256 are among the most studied primitives in all of cryptography.
  • Their assumptions are simple and well-understood.
  • There's no young, exotic mathematics that might harbour an undiscovered weakness.

The trade-off is size and ergonomics: hash-based signatures are larger than lattice signatures, and some variants (like XMSS) are stateful.

Stateful vs stateless

There are two branches of the family, split by whether they carry state:

  • Stateful (e.g. XMSS, used by QRL Legacy) — built from one-time keys; the wallet must track which keys it has used (the OTS index). Compact-ish, but demands careful state management.
  • Stateless (e.g. SPHINCS+, standardised by NIST as SLH-DSA / FIPS 205) — no index to track, at the cost of considerably larger signatures.

QRL Legacy chose the stateful XMSS. QRL 2.0 then moved to a lattice scheme, ML-DSA-87, rather than a hash-based one — getting statelessness with smaller signatures than SPHINCS+ would give.

Why this matters for QRL

Hash-based signatures are the reason QRL could credibly claim quantum resistance from 2018. While the rest of the industry waited for newer schemes to be standardised, QRL built on the most battle-tested post-quantum foundation available. The NIST standards later validated this family with SLH-DSA, alongside the lattice-based ML-DSA that QRL 2.0 adopts.

Where to go next

FAQ about Hash-based signatures

Common questions about this page
What is a hash-based signature?
A digital signature whose security rests entirely on the properties of a hash function, rather than on number-theoretic problems like factoring or discrete logs. Because hash functions resist quantum attack well, hash-based signatures are a trusted post-quantum option.
Why are hash-based signatures considered very safe?
Their security relies only on well-understood, conservative assumptions about hash functions — among the most studied primitives in cryptography. There's no exotic math to be surprised by, which is why they're often called the most conservative post-quantum choice.
What's the difference between XMSS and SPHINCS+?
Both are hash-based. XMSS is stateful — it must track which one-time keys are used. SPHINCS+ (standardised as SLH-DSA) is stateless, trading larger signatures for not needing to track state. QRL Legacy uses XMSS.
← Back to Learn