When it comes to stateful schemes, would you really need to use a Merkle tree?

Couldn't you sign the hash of the message concatenated to the hash of the new public key?

New public key: hash(hash(message) || hash(WOTS+/lamport public key))

Then for every new signature you include the previous signature(s) (without the messages).

Is the only downside of this the growing signature size or is there a security fault?

  • $\begingroup$ There is a sort of security leak in that you must attach the hashes for all previously-signed files to any new signature. (But also, yeah, a signature that grows like that is horrendous outside of an academic context.) $\endgroup$ Commented Jun 23, 2022 at 15:29
  • $\begingroup$ (Possible mitigation to this leak: salting messages before you sign them) $\endgroup$ Commented Jun 23, 2022 at 15:31

1 Answer 1


This is how stealth addresses are generated in Haircomb, you hash garbage values together with existing public key, to get a new public key. The garbage values have a specific format, that is of liquidity stack which pays 0 coins to the garbage address.

It isn't really a signature scheme, but rather a commit-reveal commitment scheme.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.