How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security assumption is based on ROM of hash functions. Does it mean the bit-security for LMS is equal to the bit-security of hash functions in QROM?

Theorem 2. Let A be an adversary attacking the security of the full LMS scheme in the multi-user setting. If A makes at most q queries, then the probability they break the existential unforgeability of any of the instances of LMS is at most $$580q/2^{n/2}$$
Given that Grover's algorithm requires $$\pi /2 \cdot 2^{n/2}$$ queries (counting the compute and the uncompute operations as two separate queries), this implies that the security is no worse than $$log_2(580 / (\pi/2)) \approx 8.5$$ bits worse than the security of the underlying hash function against Grover's algorithm.
• @namaewa: well, if they act like a random Oracle, then the bit security would be the same (however, Eaton's analysis depends on some precise details of LMS, and so it is likely different by a constant factor). However, XMSS uses (for $n=256$) SHAKE-128; that has preimage resistance of only 128 bits (against a classical internal collision attack); I'm not certain to what extend this attack would be improved with a Quantum Computer. Mar 2 at 22:37