{
  "slug": "xmss",
  "name": "XMSS / XMSS^MT",
  "aka": "eXtended Merkle Signature Scheme",
  "kind": "Digital signature (stateful)",
  "family": "Hash-based (stateful)",
  "standard": "RFC 8391 and NIST SP 800-208",
  "standard_url": "https://datatracker.ietf.org/doc/rfc8391/",
  "body": "IRTF CFRG (RFC 8391) and NIST (SP 800-208)",
  "date": "RFC 8391: 2018-05; SP 800-208: 2020-10-30",
  "status": "Final",
  "summary": "XMSS and its multi-tree variant XMSS^MT are stateful hash-based signatures specified in RFC 8391 (2018-05) and approved by NIST in SP 800-208 (2020-10). Like LMS, they are permitted under CNSA 2.0 and are used for firmware signing and in some blockchains (for example QRL).",
  "parameter_sets": [
    {
      "name": "XMSS-SHA2_10_256",
      "category": 5,
      "pk": 64,
      "sk": "varies",
      "ct_or_sig": 2500
    },
    {
      "name": "XMSS-SHA2_20_256",
      "category": 5,
      "pk": 64,
      "sk": "varies",
      "ct_or_sig": 2820
    }
  ],
  "size_label": "Signature",
  "deployments": [
    "CNSA 2.0 firmware and software signing",
    "Quantum Resistant Ledger (QRL) blockchain"
  ],
  "audit_focus": [
    "Same stateful-key risks as LMS: index reuse, state rollback, backup/restore, and multi-instance deployments",
    "Correct WOTS+ chaining and L-tree computation; hash-address (ADRS) construction",
    "Verifier-side parameter validation and bounds on index values"
  ],
  "references": [
    [
      "RFC 8391, XMSS: eXtended Merkle Signature Scheme",
      "https://datatracker.ietf.org/doc/rfc8391/"
    ],
    [
      "NIST SP 800-208",
      "https://csrc.nist.gov/pubs/sp/800/208/final"
    ]
  ],
  "url": "https://pqaudit.org/algorithms/xmss/",
  "updated": "2026-09-12"
}