The single most distinctive — and most misunderstood — property of QRL Legacy signatures is that each signing key can be used only once. This comes from the one-time signature building block inside XMSS. Here's what it means in practice.
What "one-time" really means
A one-time signature (OTS) scheme is secure only if a given key signs exactly one message. The mechanism (in XMSS, a scheme called W-OTS+) works by revealing parts of a set of secret values to prove a message. Sign once and you reveal a safe portion. Sign a second message with the same key and you reveal too much — enough that an attacker could potentially forge signatures for that key.
A single one-time key would obviously be useless for a spendable wallet. XMSS solves this by giving you many one-time keys, organised under one address via a Merkle tree, and using a fresh one for each signature.
The OTS index
To use a fresh key each time, the wallet has to remember which keys it has already spent. That counter is the OTS index. Each signature advances it by one.
Because the wallet must carry this state forward, XMSS is described as a stateful signature scheme — and the OTS index is that state. It's the price hash-based signatures pay for needing no number-theoretic assumptions.
How many signatures do I get?
The number of one-time keys — and therefore the number of times an address can ever sign — is fixed when the wallet is created, by the tree height. A height-h tree provides 2^h signatures: for example a height-10 tree allows 1,024 signatures, height-16 allows 65,536. Larger trees allow more signatures but take longer to generate.
The practical risk: stale backups
For day-to-day use, a good QRL Legacy wallet tracks the OTS index for you, so you never reuse a key by accident. The realistic danger is restoring an old backup that has fallen behind the real index — it might think a key is unused when it isn't. The safe habits are:
- keep your wallet's index state current,
- avoid importing the same seed into multiple wallets that sign independently, and
- treat a restored backup with care if it might have signed since the backup was made.
Why QRL 2.0 dropped it
The OTS rule is a real ergonomic cost, and it's exactly why QRL 2.0 switched to ML-DSA-87, a stateless scheme with no index and no reuse limit — at the cost of larger signatures. Two valid answers to the same quantum-resistance goal, with different trade-offs.
Where to go next
- XMSS explained — how the one-time keys roll up into one address.
- Hash-based signatures — the broader family.
- ML-DSA-87 explained — the stateless alternative on QRL 2.0.