# Hash-based signatures

> The family of signatures that build security from hash functions alone — the foundation under XMSS.

[XMSS](/learn/xmss-explained), the signature behind QRL Legacy, belongs to a broader family called **hash-based signatures**. Understanding the family explains *why* QRL trusted this approach years before lattice cryptography was standardised.

## Security from hashing alone

Most signatures derive their security from a "hard" math problem — factoring big numbers (RSA) or the elliptic-curve discrete log (ECDSA). Those problems are exactly what [Shor's algorithm](/learn/how-quantum-computers-break-crypto) solves, which is what makes them quantum-vulnerable.

**Hash-based signatures take a different foundation entirely.** Their security rests *only* on the properties of a [hash function](/learn/glossary#hash-function) — that it's hard to reverse (preimage resistance) and hard to find collisions. There's no number theory involved, so there's nothing for Shor's algorithm to attack. The only quantum tool that touches hashes is [Grover's algorithm](/learn/grover-and-hash-functions), and its modest speed-up is easily offset with larger hash outputs.

## The most conservative post-quantum choice

Cryptographers often call hash-based signatures the **most conservative** post-quantum option. The reason is trust:

- Hash functions like SHA-256 are among the **most studied** primitives in all of cryptography.
- Their assumptions are simple and well-understood.
- There's no young, exotic mathematics that might harbour an undiscovered weakness.

The trade-off is **size and ergonomics**: hash-based signatures are larger than lattice signatures, and some variants (like XMSS) are stateful.

## Stateful vs stateless

There are two branches of the family, split by whether they carry state:

- **Stateful** (e.g. **XMSS**, used by QRL Legacy) — built from [one-time keys](/learn/one-time-signatures-and-ots-keys); the wallet must track which keys it has used (the OTS index). Compact-ish, but demands careful state management.
- **Stateless** (e.g. **SPHINCS+**, standardised by NIST as **SLH-DSA / FIPS 205**) — no index to track, at the cost of considerably larger signatures.

QRL Legacy chose the stateful XMSS. QRL 2.0 then moved to a *lattice* scheme, [ML-DSA-87](/learn/ml-dsa-87-explained), rather than a hash-based one — getting statelessness with smaller signatures than SPHINCS+ would give.

## Why this matters for QRL

Hash-based signatures are the reason QRL could credibly claim quantum resistance from 2018. While the rest of the industry waited for newer schemes to be standardised, QRL built on the most battle-tested post-quantum foundation available. The [NIST standards](/learn/nist-post-quantum-standards) later validated this family with SLH-DSA, alongside the lattice-based ML-DSA that QRL 2.0 adopts.

## Where to go next

- [XMSS explained](/learn/xmss-explained) — QRL Legacy's hash-based signature.
- [One-time signatures and OTS keys](/learn/one-time-signatures-and-ots-keys) — the stateful detail.
- [NIST post-quantum standards](/learn/nist-post-quantum-standards) — where this family is standardised.