# XMSS explained — the signature behind QRL Legacy > How XMSS, the hash-based one-time signature scheme, lets QRL Legacy sign transactions in a way no known quantum computer can break. XMSS — the eXtended Merkle Signature Scheme — is the digital signature that secures every transaction on [QRL Legacy](/learn/glossary#qrl-legacy). It is the reason QRL was able to call itself "quantum resistant" from its 2018 launch, years before post-quantum cryptography became mainstream. This guide explains what it is and why it matters, without assuming a cryptography background. ## The problem XMSS solves Almost every other blockchain — Bitcoin, Ethereum, and the rest — signs transactions with [ECDSA](/learn/glossary#ecdsa), an elliptic-curve signature. ECDSA is fast and compact, but its security rests on a number-theoretic problem (the elliptic-curve discrete logarithm) that a large quantum computer could solve using [Shor's algorithm](/learn/glossary#shor). If that ever happens, an attacker could derive the private key from a public key and spend any exposed wallet. We cover the mechanics in [how quantum computers break cryptography](/learn/how-quantum-computers-break-crypto). XMSS takes a completely different foundation. Instead of number theory, its security rests entirely on **hash functions** — one-way functions like SHA-256. There is no known way for a quantum computer to reverse a good hash function efficiently. That single choice is what makes XMSS quantum-resistant. ## One-time signatures: the building block XMSS is built up from a primitive called a **one-time signature** (specifically W-OTS+, Winternitz one-time signatures). As the name says, a one-time key is only safe to use **once**. A one-time signature works, very roughly, by revealing parts of a set of secret values to "prove" the message. Sign one message and you reveal a safe subset; sign a second message with the *same* key and you reveal too much, and the scheme's security degrades. So a single one-time key is useless for a wallet you want to spend from repeatedly. XMSS fixes this by giving you **many** one-time keys and a way to use a fresh one for each signature. ## The Merkle tree: many keys, one address To turn thousands of throwaway one-time keys into a single, stable address, XMSS arranges them as the leaves of a **Merkle tree** — a hash tree where each node is the hash of its two children. The single value at the top of the tree, the **root**, becomes your public key. ![A Merkle tree: four one-time-signature keys sit at the leaves and are hashed pairwise up to a single root at the top, which is the wallet's public key. The OTS index marks the next unused leaf.](diagram:xmss-tree "XMSS turns many throwaway one-time keys into one stable address: the Merkle-tree root is your public key, and the OTS index tracks the next unused key.") When you sign a transaction, your wallet: 1. picks the next unused one-time key (leaf), 2. signs with it, and 3. includes the "authentication path" — the sibling hashes needed to recompute the root. Anyone can verify the signature by walking those hashes back up to the root and checking it matches your public key. The number of signatures a wallet can ever make is fixed by the **tree height**: a height-`h` tree has `2^h` one-time keys, so a height-10 tree allows 1,024 signatures, height-16 allows 65,536, and so on. ## "Stateful" — why the OTS index matters Because each one-time key must be used only once, an XMSS wallet has to **remember which keys it has already used**. This property is called being *stateful*, and the counter it keeps is the **[OTS index](/learn/glossary#ots)**. This is the single most important practical difference between XMSS and ordinary signatures: - If you restore a wallet from a backup and the backup's OTS index is behind the real one, the wallet could reuse a key — which is unsafe. - This is why QRL wallets are careful about index tracking, and why this explorer surfaces it. It is also why QRL 2.0 moved to a different scheme. [ML-DSA-87](/learn/ml-dsa-87-explained), the signature on the new chain, is **stateless** — there is no index to track — at the cost of larger signatures. ## What an XMSS address looks like A QRL Legacy address is **79 characters**: a `Q` prefix followed by 78 hex characters, encoding 39 bytes: - **3 bytes** — a descriptor recording the signature scheme and parameters, - **32 bytes** — a SHA-256 hash of the extended public key, - **4 bytes** — a checksum (the last bytes of a second SHA-256), used to catch typos. That length is a giveaway: a 79-character address is QRL Legacy, while a 41-character one is QRL 2.0. The two chains both use a `Q` prefix, so **length, not prefix, tells you the chain** — see [QRL address formats](/learn/qrl-address-formats) for the full breakdown. ## The trade-offs, honestly XMSS buys quantum resistance with two costs: - **Statefulness.** The OTS-index requirement makes wallet software more careful than a "sign anywhere, any number of times" scheme. - **Signature size.** Hash-based signatures are larger than ECDSA signatures, which means larger transactions. Those trade-offs were considered worth it for a chain whose entire premise is surviving quantum computers. They also shaped the design of QRL 2.0, which keeps the quantum-resistant goal while picking a stateless scheme. ## Where to go next - [One-time signatures and OTS keys](/learn/one-time-signatures-and-ots-keys) — a closer look at the W-OTS+ building block. - [ML-DSA-87 explained](/learn/ml-dsa-87-explained) — the stateless post-quantum signature on QRL 2.0. - [Why quantum-resistance matters](/learn/quantum-resistance-explained) — the bigger picture.