# One-time signatures and OTS keys

> Why XMSS keys can only be used once, what the OTS index is, and what it means for QRL Legacy wallets.

The single most distinctive — and most misunderstood — property of [QRL Legacy](/learn/glossary#qrl-legacy) signatures is that each signing key can be used **only once**. This comes from the **one-time signature** building block inside [XMSS](/learn/xmss-explained). Here's what it means in practice.

## What "one-time" really means

A **one-time signature (OTS)** scheme is secure only if a given key signs **exactly one** message. The mechanism (in XMSS, a scheme called W-OTS+) works by revealing parts of a set of secret values to prove a message. Sign once and you reveal a safe portion. Sign a *second* message with the same key and you reveal too much — enough that an attacker could potentially forge signatures for that key.

A single one-time key would obviously be useless for a spendable wallet. XMSS solves this by giving you **many** one-time keys, organised under one address via a [Merkle tree](/learn/glossary#merkle-tree), and using a fresh one for each signature.

## The OTS index

To use a fresh key each time, the wallet has to **remember which keys it has already spent**. That counter is the **[OTS index](/learn/glossary#ots)**. Each signature advances it by one.

Because the wallet must carry this state forward, XMSS is described as a **stateful** signature scheme — and the OTS index is that state. It's the price hash-based signatures pay for needing no number-theoretic assumptions.

## How many signatures do I get?

The number of one-time keys — and therefore the number of times an address can ever sign — is fixed when the wallet is created, by the **tree height**. A height-`h` tree provides `2^h` signatures: for example a height-10 tree allows 1,024 signatures, height-16 allows 65,536. Larger trees allow more signatures but take longer to generate.

## The practical risk: stale backups

For day-to-day use, a good QRL Legacy wallet tracks the OTS index for you, so you never reuse a key by accident. The realistic danger is **restoring an old backup** that has fallen behind the real index — it might think a key is unused when it isn't. The safe habits are:

- keep your wallet's index state current,
- avoid importing the same seed into multiple wallets that sign independently, and
- treat a restored backup with care if it might have signed since the backup was made.

## Why QRL 2.0 dropped it

The OTS rule is a real ergonomic cost, and it's exactly why [QRL 2.0](/learn/glossary#qrl2) switched to [ML-DSA-87](/learn/ml-dsa-87-explained), a **stateless** scheme with no index and no reuse limit — at the cost of larger signatures. Two valid answers to the same quantum-resistance goal, with different trade-offs.

## Where to go next

- [XMSS explained](/learn/xmss-explained) — how the one-time keys roll up into one address.
- [Hash-based signatures](/learn/hash-based-signatures) — the broader family.
- [ML-DSA-87 explained](/learn/ml-dsa-87-explained) — the stateless alternative on QRL 2.0.