XMSS / XMSS^MT (eXtended Merkle Signature Scheme): standard, dates, parameters, and audit checklist
================================================================================

XMSS and its multi-tree variant XMSS^MT are stateful hash-based signatures specified in RFC 8391 (2018-05) and approved by NIST in SP 800-208 (2020-10). Like LMS, they are permitted under CNSA 2.0 and are used for firmware signing and in some blockchains (for example QRL).

Standard: RFC 8391 and NIST SP 800-208
Standardized by: IRTF CFRG (RFC 8391) and NIST (SP 800-208)
Date: RFC 8391: 2018-05; SP 800-208: 2020-10-30
Status: Final
Family: Hash-based (stateful)
Parameter sets: XMSS-SHA2_10_256 (cat 5, pk 64 B, signature 2500 B); XMSS-SHA2_20_256 (cat 5, pk 64 B, signature 2820 B)
Audit focus: Same stateful-key risks as LMS: index reuse, state rollback, backup/restore, and multi-instance deployments | Correct WOTS+ chaining and L-tree computation; hash-address (ADRS) construction | Verifier-side parameter validation and bounds on index values
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://datatracker.ietf.org/doc/rfc8391/ | https://csrc.nist.gov/pubs/sp/800/208/final

Source page: https://pqaudit.org/algorithms/xmss/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12