LMS / HSS (Leighton-Micali Signatures, Hierarchical Signature System): standard, dates, parameters, and audit checklist
================================================================================

LMS and its multi-tree variant HSS are stateful hash-based signatures specified in RFC 8554 (2019-04) and approved by NIST in SP 800-208 (2020-10). They are the signature schemes CNSA 2.0 requires for firmware and software signing, and are the first post-quantum signatures many hardware roots of trust support.

Standard: RFC 8554 and NIST SP 800-208
Standardized by: IETF / IRTF CFRG (RFC 8554) and NIST (SP 800-208)
Date: RFC 8554: 2019-04; SP 800-208: 2020-10-30
Status: Final
Family: Hash-based (stateful)
Parameter sets: LMS_SHA256_M32_H10 (typical) (cat 5, pk 60 B, signature 1456 B); HSS with 2 levels of H10 (typical) (cat 5, pk 60 B, signature 2964 B)
Audit focus: State management is the whole game: a one-time key reused once allows forgery. Audit state persistence, atomic updates, backups, HSM cloning, and crash recovery | SP 800-208 restricts key generation and signing to hardware cryptographic modules for FIPS validation | Parameter-set validation on the verifier, including the Winternitz parameter and tree height | Domain separation constants and the exact hash-input layouts of RFC 8554
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://datatracker.ietf.org/doc/rfc8554/ | https://csrc.nist.gov/pubs/sp/800/208/final

Source page: https://pqaudit.org/algorithms/lms-hss/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12