Based on the NIST submission it looks like the
SPHINCS+-256s algorithm comes in at public key sizes of 64 bytes, private key sizes of 128 bytes, and signature sizes of 29,792 bytes.
What I can't seem to locate (or understand from the submission documentation) are implementation details suggesting how to use it. For that I have the following questions (all specifically for the
How many signatures can you safely get out of it?
Are the signatures one-time use, or can you sign something and have it verified repeatedly without giving up the private key? (I'm assuming this is the "stateless" aspect, but want to be certain I'm not misunderstanding it.)
Are there any specific caveats involved?
The protocol I'm thinking of implementing with it would be along the lines of:
Publish the public key, signed with a different signature algorithm.
Retain the secret key.
Sign N messages, post signatures and messages publicly for verification.
What I'm trying to avoid would be the one-time signature aspects of most hash-based signature protocols where you sign something, distribute the thing, then post the solution proving you signed it at some later point while simultaneously making it unverifiable to future parties (since you give up the private information in the process of proving the signature belonged to you.)