hash-based signature

Hash-based signatures build digital signatures from a hash function alone — no elliptic curves, no number theory. That makes them the most conservative post-quantum option: their security rests only on hash preimage and collision resistance, which Shor's quantum algorithm does not break (Grover's gives only a square-root speedup, easily countered by larger outputs).

The atom is a one-time signature (OTS). In Lamport's scheme, the secret key is pairs of random values, you publish their hashes as the public key, and to sign each bit of the message digest you reveal one preimage from the matching pair. It is secure but single-use and large. Winternitz (WOTS) shrinks this by signing several bits at once along hash chains. Merkle's insight makes a one-time scheme many-time: place 2^h OTS public keys as the leaves of a Merkle tree, publish the tree root as your long-lived public key, and have each signature carry one OTS plus its authentication path up to the root.

Standardized schemes split on state. XMSS and LMS are STATEFUL — you must never reuse a leaf, because reusing an OTS key leaks the secret, so the signer carefully tracks an index. SPHINCS+ is STATELESS, picking leaves pseudo-randomly from an enormous tree, at the cost of larger signatures (roughly 8 to 50 KB). Versus ECDSA the trade-off is bigger signatures and, for stateful variants, perilous state management — but rock-solid quantum resistance, which makes them attractive for long-lived keys like firmware signing and an eventual blockchain migration.