SPHINCS+ is an interesting post-quantum algorithm, and I'm curious about what its limitations are. What I know about hash-based signature formats in the past are that you needed to remember which signing key branches have been "used"--statefulness--and that the tree could only be used for a certain number of signatures.
I've looked at various stuff online about SPHINCS+, but I don't understand it enough to know whether it has these limitations, or what those limits are.
I've looked at various stuff online about SPHINCS+, but I don't understand it enough to know whether it has these limitations, or what those limits are.
The limitation of Sphincs+ is that you are limited to signing $2^{64}$ messages with any private key. You don't need to remember what messages you signed, or track any other state. It works like any other standard signing operation; you take a message and the private key, and it generates a signature.
Actually, if you go beyond $2^{64}$ messages, the security of Sphincs+ degrades fairly slowly; just signing a factor of (say) 10 more messages (that is, you sign $10 \cdot 2^{64}$ messages with that private key) doesn't impact security all that much.
You could try to claim that you ought to track the number of signatures you generated so far, however as a practical issue, you really don't. $2^{64}$ is a huge number of messages; I believe NIST mandated that because they couldn't imagine anyone signing that many messages with a single key (and I can't either).
