I understand how WOTS+ signing works: I create a secret key and put it into leaves of my binary tree and hash it with some random values in the binary tree with my chaining function until the root is created, which is the public key.

But how do I combine that with the XMSS L-Trees?


1 Answer 1


The XMSS tree is constructed using the W-OTS keys. Each leaf of the XMSS tree corresponds to a distinct W-OTS key. The W-OTS keys have length $ln$, but each node of the XMSS tree should have length $n$.

In order to make the size of the W-OTS keys compatible with the XMSS tree, the L-tree is used to first reduce the W-OTS key from $ln$ to $n$ bits.The L-tree divides the W-OTS key into $l$ $n$-bit strings, which then form the $l$ leaves of the L-tree. The root of the L-tree is $n$ bits and can be used as a leaf in the XMSS tree.

Source: "XMSS – A Practical Forward Secure Signature Scheme based on Minimal Security Assumptions" from Buchmann and Hülsing


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.