SPHINCS+: Post-Quantum Signature Scheme

Updated 3 July 2026

SPHINCS+ is a stateless, hash-based digital signature scheme that uses FORS, WOTS+, and Merkle hypertree constructions to achieve post-quantum security.
Its security is based solely on the strength of collision-resistant hash functions in the quantum random oracle model, ensuring provable EUF-CMA security while incurring larger signature sizes.
Ongoing research focuses on parameter optimization and hardware acceleration to mitigate performance overhead, making SPHINCS+ viable for blockchain protocols and embedded systems.

SPHINCS+ is a stateless, hash-based digital signature scheme designed for post-quantum security. Standardized as NIST FIPS 205, its security is based solely on the cryptographic strength of hash functions instantiated in the quantum random oracle model. SPHINCS+ achieves EUF-CMA security without reliance on structured hardness assumptions (lattice, code, or multivariate), supporting parameter sets suitable for 128-, 192-, and 256-bit classical security. Its design leverages a hierarchical composition of few-time and one-time signature schemes (FORS, WOTS+) and a multi-level Merkle hypertree to instantiate large numbers of ephemeral keys in a provably stateless fashion. While its parallelism and minimal security assumptions are notable, SPHINCS+ incurs significant performance and signature size overhead relative to lattice-based designs, motivating both aggressive parameter optimization and hardware- or architecture-specific acceleration research.

1. Core Structure and Algorithms

SPHINCS+ is built from three fundamental modules: FORS (Forest of Random Subsets), WOTS+ (Winternitz One-Time Signature Plus), and a hypertree structure comprising layers of Merkle trees.

FORS is a few-time signature constructed from $k$ parallel binary hash trees of height $a$ . Each tree signs a segment of the message digest by opening a path from the root to the leaf indexed by message bits. The FORS signature is the set of revealed leaves and corresponding authentication paths; the FORS public key is the hash-compression of all root nodes.
WOTS+ is a practical one-time signature using hash chains, parameterized by the Winternitz parameter $w$ . For a hash output length $n$ and message length $\ell$ , the chain depth and checksum amount are set to ensure $2^{n}$ security. Its hash functions are domain-separated via address and seed inputs.
Hypertree is a $d$ -layer construction, each layer being an XMSS Merkle tree with WOTS+ leaves. The hypertree attests the output of FORS, propagating the authentication through WOTS+ signatures and Merkle paths up to a global root.

Signatures ( $\sigma$ ) consist of the randomness $R$ , the FORS signature, and the set of WOTS+ signatures plus all Merkle authentication paths required to link the message to the public root.

Signing for message $M$ involves:

$a$ 0
$a$ 1
$a$ 2
$a$ 3
$a$ 4

Verification reconstructs the root via FORS and hypertree verification, accepting if this equals the public root.

The fully stateless architecture ensures that each signing invocation derives ephemeral keys on demand from seeds, eliminating side-channel and key-exhaustion risks (Chiano et al., 2021).

2. Security Foundations and Quantum Analysis

The security of SPHINCS+ is based solely on the collision-resistance, one-wayness, and pseudorandomness of the underlying hash family. The primary proof model is the quantum random oracle model (QROM); reductions in the literature show that a successful forgery against SPHINCS+ with $a$ 5 hash and $a$ 6 signature queries can be reduced to either:

Breaking the PRF underlying $a$ 7
Collision resistance in $a$ 8 or hypertree hash (Merkle tree or WOTS+ one-time signature)
Finding a forgery for the WOTS+ or FORS commit-and-authenticate layers

A detailed attack model incorporating quantum decoherence and imperfect parallelism, together with sharpened entropy-concentration inequalities, is provided in (Xu et al., 6 Aug 2025). Key points:

Quantum adversaries are modeled as $a$ 9-quantum attackers with decoherence channel $w$ 0, parallelization map $w$ 1, and QROM oracle.
The success probability of a quantum attack decays exponentially with circuit depth and with only sublinear gains from $w$ 2-processor parallelism due to decoherence-induced mixing.
Improved entropy concentration (Lemma 5.2 and Theorem 7.1) reduces the collision bound constants for hash output length determination from 2 to 3, enabling a practical 15–20% reduction in hash output length and signature size for the same security level.

The optimized NIST Level 1 SPHINCS+ parameterization can target a 222-bit collision entropy (vs. 256 bits originally), yielding $w$ 36.7 KB signatures (vs. 8.0 KB) with no decrease in provable QROM security guarantee (Xu et al., 6 Aug 2025).

3. Parameter Sets, Hash Instantiations, and Variants

SPHINCS+ offers parameter sets tuned for different trade-offs:

“f” (fast) variants: minimize signing/verification time at the cost of larger signatures.
“s” (small) variants: reduce signature size with the expense of increased hash/computation calls.

Canonical choices use SHA-2, SHAKE256, or Haraka hash functions. Full interoperability with other XOFs (e.g., Streebog (Kiktenko et al., 2019), algebraic expanders (Cherkaoui et al., 10 Feb 2026)) is possible as long as collision and preimage resistance are ensured.

Key and signature sizes (typical, SHAKE256):

Variant	Public Key	Private Key	Signature Size
128f	64 B	128 B	~8 KB
128s	64 B	128 B	~17 KB
192f	64 B	128 B	~14 KB
192s	64 B	128 B	~30 KB
256f	64 B	128 B	~30 KB
256s	64 B	128 B	~63 KB

(Chiano et al., 2021)

Alternative hash instantiations (Streebog in (Kiktenko et al., 2019); SL $w$ 4 in (Cherkaoui et al., 10 Feb 2026)) show close security correspondence with marginal performance degradation (5–8% for Streebog vs. SHA-2/SHAKE), and can enable algebraic soundness if quantum resistance of graph-walk collisions is desired (Cherkaoui et al., 10 Feb 2026).

4. Performance, Implementations, and Hardware Acceleration

Software implementations of SPHINCS+ exhibit high computational cost due to the volume of hash computations. For instance, on an ARM Cortex-M4 (STM32F407G):

Key generation and signing: $w$ 510 minutes each (reference: $w$ 6)
Verification: fails due to unmanageable hashing volume
Memory usage for the 128-bit set: within $w$ 7 SRAM, but with negligible headroom
The underlying bottleneck: $w$ 8 hash compressions $w$ 92,000 per signature (Yıldırım et al., 14 Jun 2026)

For lattice-based Dilithium, key generation overflows memory on embedded MCUs, while SPHINCS+ completes but is orders of magnitude too slow for real-time applications; only hardware/software code-sign partitioning promises practical performance. Platform-specific hardware-accelerated approaches (offloading SHAKE256 to hardware, Merkle tree engines) reduce per-signature latency from minutes to milliseconds (Yıldırım et al., 14 Jun 2026).

Modern GPU implementations leverage the high parallelizability of FORS and WOTS+ layers:

HERO-Sign (Zhou et al., 30 Dec 2025) employs tree fusion, autotuning, and kernel-specific register/block specialization.
Tree-fused FORS computation and adaptive compilation (PTX/native) elevate occupancy from 17–25% (baseline) to 35–64% (optimized).
On NVIDIA RTX 4090, HERO-Sign yields $n$ 0 to $n$ 1 throughput improvement vs. baseline for 128f–256f parameters; kernel launch latency is reduced by up to $n$ 2 using CUDA Graphs.

Comparative x86/ARM performance (mean for “fast” variants):

Hardware	Sign (ms)	Verify (ms)	Reference
ARM M1 (128f)	14.50	0.871	(Schemitt et al., 10 Oct 2025)
x64 (i7-1360P)	6.54	0.493	(Schemitt et al., 10 Oct 2025)
AMD Ryzen 5800X	5.60	0.436	(Schemitt et al., 10 Oct 2025)

SPHINCS+ is one to two orders of magnitude slower than lattice-based Dilithium or Falcon for signing, and generates larger signatures. Verification is %%%%33 $a$ 034%%%% slower than ECDSA at Level 1, converging to $n$ 51.5 $n$ 6 at Level 5 (Schemitt et al., 10 Oct 2025). In blockchain simulations, SPHINCS+ verification rates dominate overall block validation latency (Schemitt et al., 10 Oct 2025).

5. Parameter Optimization and Security Reductions

Advanced analysis of SPHINCS+ security under quantum attack models enables more efficient parameter selection:

Quantum adversaries experience decoherence, limiting the actual advantage from parallel quantum processors: the attack success drops as $n$ 7 and with $n$ 8 for circuit time $n$ 9 (Xu et al., 6 Aug 2025).
Rényi entropy concentration inequalities (Lemma 5.2) improve bounds in setting the necessary hash output length for a given security level.
For NIST Level 1, the optimized output length $\ell$ 0 can be reduced from 256 bits to 214 bits (plus safety margin), yielding signature sizes of $\ell$ 16.7 KB (original: $\ell$ 2 KB) (Xu et al., 6 Aug 2025).
The table below summarizes the gain:

Parameter	Original (Level 1)	Optimized (Level 1)	Reduction
hash length	256 bits	214 bits	16.4%
signature size	8.0 KB	6.7 KB	16.3%

The new bounds, incorporating modeling of decoherence and parallelization limits, provide a methodology for tight yet resource-efficient SPHINCS+ deployment under realistic quantum threat models.

6. Alternative Hash Instantiations and Theoretical Extensions

SPHINCS+ allows arbitrary (collision-resistant, one-way) hash family instantiation, as shown by Streebog-based and algebraic hash function studies:

Streebog (Kiktenko et al., 2019): Drop-in replacement for SHA-2/SHAKE. Benchmarking shows ≤8% signing and ≤5% verification time penalty, signature sizes and parameters unchanged.
Spinel (SL $\ell$ 3 hash) (Cherkaoui et al., 10 Feb 2026): Replaces all internal hashes with domain-separated non-backtracking walks in $\ell$ 4. This expands security assumptions from hash-oracle to expander-graph properties. Performance decreases by $\ell$ 5 for signing, $\ell$ 6– $\ell$ 7 for verification, and signature size increases by 20–30%. Security proofs extend via direct reduction to the algebraic collision-resistance and the standard SPHINCS+ QROM analysis. Spinel demonstrates the flexibility and abstraction-level security possible in the SPHINCS+ framework.

7. Applications, Comparative Assessment, and Limitations

SPHINCS+ is suitable where minimal security assumptions (collision-resistant hashes), stateless operation, and high parallelism are required. Its main application contexts include PQ-safe digital signatures for software and embedded systems, blockchain protocols, and as a drop-in for cryptosystems phasing out ECDSA and other quantum-vulnerable primitives.

Strengths: Well-studied security, hash-only assumptions, no state-management
Limitations: Large signature size (4–65 KB typical), slower sign/verify (milliseconds–minutes without hardware acceleration), significantly outperformed by MLWE lattice schemes (e.g., Dilithium) in both performance and signature size

Current research emphasizes architectural optimizations for high-performance deployments, with hardware acceleration (FPGA, GPU) demonstrably converting SPHINCS+ from impractical to performant in throughput-sensitive systems such as public blockchains or embedded controllers (Yıldırım et al., 14 Jun 2026, Zhou et al., 30 Dec 2025).

References: