LMS / HSS (Leighton-Micali Signatures, Hierarchical Signature System)

Type

Digital signature (stateful)

Family

Hash-based (stateful)

Standard

RFC 8554 and NIST SP 800-208

Standardized by

IETF / IRTF CFRG (RFC 8554) and NIST (SP 800-208)

Date

RFC 8554: 2019-04; SP 800-208: 2020-10-30

Status

Final

Last reviewed 2026-09-12 by the PQC Audit Index editors.

Parameter sets and sizes (bytes)

NIST security categories: 1 ≈ AES-128, 2 ≈ SHA-256 collision, 3 ≈ AES-192, 5 ≈ AES-256.

Where LMS / HSS is deployed

• CNSA 2.0 firmware and software signing (exclusive use required by 2030)
• Hardware roots of trust, secure boot, HSM-backed code signing

What an audit of LMS / HSS checks

• State management is the whole game: a one-time key reused once allows forgery. Audit state persistence, atomic updates, backups, HSM cloning, and crash recovery
• SP 800-208 restricts key generation and signing to hardware cryptographic modules for FIPS validation
• Parameter-set validation on the verifier, including the Winternitz parameter and tree height
• Domain separation constants and the exact hash-input layouts of RFC 8554

See the full post-quantum cryptography audit checklist.

Who audits LMS / HSS implementations

Firms with a cryptography practice that review LMS / HSS implementations and protocol integrations, in the order this index lists them:

1. zkSecurity — Cryptography audits: post-quantum, zero-knowledge proofs, MPC, FHE, TEEs
2. Trail of Bits — Software assurance with a dedicated cryptography practice
3. NCC Group (Cryptography Services) — Large security consultancy with a specialist Cryptography Services team
4. Cryspen — Formally verified cryptography and high-assurance post-quantum implementations
5. Kudelski Security — Cryptography audits and quantum-readiness assessments
6. Quarkslab — Reverse engineering, cryptography, and secure implementation research
7. Least Authority — Security audits of cryptographic protocols and privacy-preserving systems
8. Galois — Formal verification of cryptographic code
9. atsec information security — FIPS 140-3 and CAVP validation laboratory
10. Riscure (Keysight) — Side-channel and fault-injection evaluation of hardware implementations
11. Cure53 — Penetration testing and code audits of open-source and web software
12. X41 D-Sec — Source-code audits of open-source security and cryptographic software

Primary sources

• RFC 8554, Leighton-Micali Hash-Based Signatures
• NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes

Machine-readable: data.json · summary.txt