Why is WOTS-type signature schemes OTS?

Question

I'm sure I've missed something super trivial, but why are WOTS-type schemes one-time? I've been looking into hash-based schemes, and I feel like I understand WOTS quite well (specifically I have looked at WOTS+), but I cannot figure out why WOTS would not be safe to use just a few times as an FTS such as HORS(T) for example?

Answer 1

I'll only talk about things on a very high level here, probably much higher than what you already know and will use Matthew Green's blog post as the primary reference. Nevertheless the idea should come across.

So in that post, WOTS is described as a smart way to have more than two (0 and 1) lists of of secret key values to publish as the signature. Now what you do is that for each symbol (eg byte), you publish one entry from these lists (in a smart way). But if you do this twice for different message which differ in at least 2 bytes, you can take one byte from the one and one byte from the other signature to forge a new signature! Also note that (as far as I can tell), it's usually not assumed for this kind of signature scheme to mandate hashing the input and only passing the hash to the signature primitive.