Is XMSS quantum-safe?

XMSS has no known quantum attack. Its security depends only on the strength of its hash function, and the best quantum attack on a hash function (Grover's algorithm) gives just a square-root speed-up, which is offset by using a large enough hash output. It does not rely on the number-theoretic problems Shor's algorithm breaks.

A one-time signature (OTS) key is a signing key that is safe to use exactly once. XMSS is built from many one-time keys arranged in a tree, and QRL Legacy tracks which ones have been used so a key is never reused.

What happens if an XMSS key is reused?

Reusing a one-time key leaks information that can weaken the signature's security. This is why XMSS is 'stateful' — the wallet must remember its OTS index. QRL Legacy enforces this; ML-DSA-87 on QRL 2.0 is stateless and has no such requirement.

Why are XMSS addresses so long?

A QRL Legacy address is 79 characters (a Q prefix plus 78 hex). It encodes a 39-byte value: a 3-byte descriptor of the signature parameters, a 32-byte SHA-256 hash of the public key, and a 4-byte checksum.

XMSS Explained — QRL's Hash-Based Quantum-Safe Signature

XMSS — the eXtended Merkle Signature Scheme — is the digital signature that secures every transaction on QRL Legacy. It is the reason QRL was able to call itself "quantum resistant" from its 2018 launch, years before post-quantum cryptography became mainstream. This guide explains what it is and why it matters, without assuming a cryptography background.

The problem XMSS solves

Almost every other blockchain — Bitcoin, Ethereum, and the rest — signs transactions with ECDSA, an elliptic-curve signature. ECDSA is fast and compact, but its security rests on a number-theoretic problem (the elliptic-curve discrete logarithm) that a large quantum computer could solve using Shor's algorithm. If that ever happens, an attacker could derive the private key from a public key and spend any exposed wallet. We cover the mechanics in how quantum computers break cryptography.

XMSS takes a completely different foundation. Instead of number theory, its security rests entirely on hash functions — one-way functions like SHA-256. There is no known way for a quantum computer to reverse a good hash function efficiently. That single choice is what makes XMSS quantum-resistant.

One-time signatures: the building block

XMSS is built up from a primitive called a one-time signature (specifically W-OTS+, Winternitz one-time signatures). As the name says, a one-time key is only safe to use once.

A one-time signature works, very roughly, by revealing parts of a set of secret values to "prove" the message. Sign one message and you reveal a safe subset; sign a second message with the same key and you reveal too much, and the scheme's security degrades. So a single one-time key is useless for a wallet you want to spend from repeatedly.

XMSS fixes this by giving you many one-time keys and a way to use a fresh one for each signature.

The Merkle tree: many keys, one address

To turn thousands of throwaway one-time keys into a single, stable address, XMSS arranges them as the leaves of a Merkle tree — a hash tree where each node is the hash of its two children. The single value at the top of the tree, the root, becomes your public key.

XMSS turns many throwaway one-time keys into one stable address: the Merkle-tree root is your public key, and the OTS index tracks the next unused key.

When you sign a transaction, your wallet:

picks the next unused one-time key (leaf),
signs with it, and
includes the "authentication path" — the sibling hashes needed to recompute the root.

Anyone can verify the signature by walking those hashes back up to the root and checking it matches your public key. The number of signatures a wallet can ever make is fixed by the tree height: a height-h tree has 2^h one-time keys, so a height-10 tree allows 1,024 signatures, height-16 allows 65,536, and so on.

"Stateful" — why the OTS index matters

Because each one-time key must be used only once, an XMSS wallet has to remember which keys it has already used. This property is called being stateful, and the counter it keeps is the OTS index.

This is the single most important practical difference between XMSS and ordinary signatures:

If you restore a wallet from a backup and the backup's OTS index is behind the real one, the wallet could reuse a key — which is unsafe.
This is why QRL wallets are careful about index tracking, and why this explorer surfaces it.

It is also why QRL 2.0 moved to a different scheme. ML-DSA-87, the signature on the new chain, is stateless — there is no index to track — at the cost of larger signatures.

What an XMSS address looks like

A QRL Legacy address is 79 characters: a Q prefix followed by 78 hex characters, encoding 39 bytes:

3 bytes — a descriptor recording the signature scheme and parameters,
32 bytes — a SHA-256 hash of the extended public key,
4 bytes — a checksum (the last bytes of a second SHA-256), used to catch typos.

That length is a giveaway: a 79-character address is QRL Legacy, while a 41-character one is QRL 2.0. The two chains both use a Q prefix, so length, not prefix, tells you the chain — see QRL address formats for the full breakdown.

The trade-offs, honestly

XMSS buys quantum resistance with two costs:

Statefulness. The OTS-index requirement makes wallet software more careful than a "sign anywhere, any number of times" scheme.
Signature size. Hash-based signatures are larger than ECDSA signatures, which means larger transactions.

Those trade-offs were considered worth it for a chain whose entire premise is surviving quantum computers. They also shaped the design of QRL 2.0, which keeps the quantum-resistant goal while picking a stateless scheme.

Where to go next

One-time signatures and OTS keys — a closer look at the W-OTS+ building block.
ML-DSA-87 explained — the stateless post-quantum signature on QRL 2.0.
Why quantum-resistance matters — the bigger picture.

XMSS explained — the signature behind QRL Legacy