---
title: One-Time Signature (OTS) Overview
url: https://www.emergentmind.com/topics/one-time-signature-ots
type: topic
---

# One-Time Signature (OTS) Overview

A one-time signature (OTS) is a digital signature primitive in which a generated key pair is secure for authenticating exactly one message; using a key for more than a single signing operation (even on two distinct messages) may enable strong existential forgery. OTS schemes form the foundation for numerous stateful and stateless many-time hash-based signature constructions, underlie signing in post-quantum cryptography, and have been extended to handle advanced adversarial models such as key exposure, side-channel attacks, and quantum-access threats.

## 1. Core Constructions: Lamport, Winternitz, and PRNG-based OTS

The canonical OTS scheme is the Lamport construction, which provides classical existential unforgeability (EUF-CMA) from minimal assumptions. Let $n$ be the hash security parameter and $m$ the message bit length. The Lamport secret key is a vector of $2m$ random bitstrings, and the public key is their hash images. To sign, the signer reveals one preimage per message bit. Lamport OTS has optimal simplicity but large keys and signatures ($O(mn)$ bits).

The Winternitz OTS (“W-OTS”) reduces signature size by encoding the message in base $w$ and using hash chains. The secret key consists of $l$ random values; the public key is the $w-1$ iterated hash of each. The signer reveals sufficiently many hashings to match the message+checksum digits. Security is proven under one-wayness, second-preimage resistance, and a non-trivial “undetectability” property for the hash [2002.07419], [2103.12448]. Quantum-access security of the Winternitz OTS has been established under the blind unforgeability model, showing negligible success probability for superposition adversaries provided the output length $n$ and chain length $l$ are suitably chosen [2103.12448].

Recent schemes replace hash chains with pseudorandom number generator (PRNG) chains. For instance, a construction based on an iterated linear congruential generator (LCG) produces compact key pairs and signatures ($\ell$ bits per key, $\ell + w$ bits per signature, see Table below), at the cost of relying directly on PRNG one-wayness rather than general hash assumptions [2501.10393].

| Scheme               | Key Size        | Signature Size        | Security Assumption                |
|----------------------|----------------|-----------------------|------------------------------------|
| Lamport OTS          | $2m n$ bits    | $m n$ bits            | Hash preimage/collision resistance |
| Winternitz-O($w$) OTS| $O(ln)$ bits   | $O(ln)$ bits          | Hash OW/SPR/UD                     |
| PRNG-OTS             | $\ell$ bits    | $\ell+w$ bits         | PRNG one-wayness                   |

## 2. Security Models and Rigorous Bounds

OTS schemes are defined by a single-use security game: after observing a signature on one message, it should be infeasible for an adversary to forge a valid signature on any distinct message. Classical proofs for Lamport and Winternitz OTS reduce forgeries to inverting a hash or finding a second preimage, but detailed reductions require careful accounting when checking which chain elements may be exposed [2002.07419].

For W-OTS$^+$, the tight bound for existential unforgeability against one-time adversaries making $t$ queries is (for $l$ chains of length $w$):
\[
\mathrm{Succ}_{\mathcal{A}} < l\,w\;\Bigl(w\,\mathrm{InSec}^{\mathrm{UD}} + \mathrm{InSec}^{\mathrm{OW}} + w\,\mathrm{InSec}^{\mathrm{SPR}}\Bigr),
\]
where UD (undetectability) corrects a subtle flaw in earlier proofs [2002.07419].

Quantum-access adversaries in the QROM (quantum random oracle model) are bounded as follows [2103.12448]:
\[
\Pr[\text{forgery}] \leq (l+1)\,2^{-n} + O(q^2\,w^4\,2^{-n}).
\]
A direct implication is that $n$ must be chosen significantly larger than the desired security level to counter the quadratic Grover speedup in quantum settings.

The PRNG-based OTS is secure if the output function $f_{2^w-1}(x)$ is cryptographically one-way and the normalization hash prevents collision attacks [2501.10393].

## 3. Key Exposure and Leakage-resilient OTS

Classical OTS schemes do not tolerate secret key leakage; knowledge of the entire state after one signature trivially enables forgeries. The OTS-SKE model [2201.01834] introduces a construction in which even given all session keys, no adversary can forge on a new message or session. This is achieved with a session/key-derivation architecture:

- Each signing key $sk_i$ is split into $q = n \cdot t$ subkeys.
- For each message $M$, a pseudorandom index $I$ selects a unique subset of subkeys to participate in the signature.
- Subset selection uses a PRP (pseudorandom permutation), and each subset, once accessed, is irreversibly erased (key insulation).
- Security relies on the inability to reconstruct untouched subkey subsets after leakage.

This model is formalized through the OTS-SKE game: adversaries given all revealed signing material for any previously signed message must break CDH in the underlying group to succeed [2201.01834]. The architecture leverages an on-chip one-way hardware key generator and an oblivious transfer memory to enforce per-session key erasure, ensuring both forward and backward security.

OTS-SKE can outperform ECDSA in signing latency but incurs higher key generation overhead.

## 4. Parameter Selection, Performance, and Efficiency Trade-offs

Signature length, key sizes, and computational cost are driven by the security parameter ($n$), message length ($m$), and the Winternitz/compression parameter ($w$):

- Lamport OTS: $O(mn)$ keys and signatures, one hash per bit.
- Winternitz OTS: Compresses size by $w$, increasing computational work per message symbol. Empirically, with $m=256$, $w=16$, one obtains $l=67$ hash chains (see "Security analysis of the W-OTS$^+$ signature scheme" [2002.07419]).
- PRNG-based OTS: Orders of magnitude smaller signatures but at the risk of weak PRNG parameterization [2501.10393].

| Scheme / Parameter                    | Example Sizes                              |
|---------------------------------------|--------------------------------------------|
| Lamport ($n=128$, $m=128$)            | Key: 32,768 bits; Signature: 16,384 bits   |
| Winternitz ($w=16$, $n=128$, $m=128$) | Key: $\sim$1152 bits; Signature: $\sim$1152 bits |
| PRNG-OTS ($\ell=128$, $w=24$)         | Key: 128 bits; Signature: 152 bits         |

The efficiency of OTS schemes also depends on implementation details (e.g., use of modular arithmetic vs. hash calls). For PRNG-OTS, timings ranged from hundreds of milliseconds for 31- to 56-bit modulus LCGs [2501.10393]. Hardware-aided key generation in OTS-SKE amortizes the high initial cost, and signing outpaces ECDSA by a factor of $7$ in targeted applications [2201.01834].

## 5. Applications in Cryptographic Protocols

Hash-based OTS schemes are critical for post-quantum digital signatures (e.g., as base layers for XMSS, SPHINCS, and SPHINCS+), and for stateless, forward-secure authentication. W-OTS[+] in particular is deployed as a building block for many-time stateless hash-based signatures [2002.07419], [2103.12448].

Beyond cryptography per se, OTS primitives provide strong guarantees for secure remote attestation facing key exposure [2201.01834]. In distributed payment networks, “OTS-PC” leverages hash-based OTS (as an abstract primitive) for bidirectional payment channels on the Lightning Network, enabling $O(1)$ storage per channel by rotating minimal OTS keys at each channel state; signatures of 36 bytes and pubkeys of 32 bytes are realized assuming strong preimage resistance for the base hash function [2511.04021].

## 6. Limitations, Open Problems, and Future Work

All standard OTS schemes are strictly “one-time”; key reuse admits trivial attacks, due to leakage of intermediate key material or hash/PRNG states [2501.10393]. While Winternitz and Lamport constructions are well-understood under hash-based assumptions, PRNG-based OTS requires careful selection of parameters due to known structural weaknesses in many PRNGs, especially concerning lattice attacks on classic LCGs. There is an identified need for formal quantum-random-oracle reductions for PRNG-based OTS and for new constructions offering multi-time signatures with one-time security per instance [2501.10393].

Quantum-specific OTS (“one-shot signatures,” OSS) extend the OTS paradigm into quantum signing keys and verification via quantum public states, but efficient, usability-focused OSS remain an active area for ongoing research [2510.10899].

## 7. Variants and Security Extensions

Several variants of OTS have emerged to satisfy additional threat models:

- OTS-SKE specifically achieves unforgeability under secret-key exposure, suitable for adversaries able to mount full-state digital observation attacks, by blending PRP-selected key subset release and hardware-backed erasure [2201.01834].
- OTS schemes tailored for on-chain usage, e.g., OTS-PC, adapt the OTS abstraction to resource-constrained distributed ledger environments and use generic hash-based instantiations [2511.04021].
- One-shot (quantum) signature schemes provide an OSS that restricts a quantum signing state to a single operation, with security fundamentally rooted in quantum properties [2510.10899].

Practical, future-proof OTS research intersects with the precise selection of underlying cryptographic primitives, secure parameterization for post-quantum settings, performance evaluations for both software and hardware deployments, and compositional use within broader cryptographic protocols.

Source: https://www.emergentmind.com/topics/one-time-signature-ots