---
title: 'SPHINCS+: Post-Quantum Signature Scheme'
url: https://www.emergentmind.com/topics/sphincs
type: topic
---

# SPHINCS+: Post-Quantum Signature Scheme

SPHINCS+ is a stateless, hash-based digital signature scheme designed for post-quantum security. Standardized as NIST FIPS 205, its security is based solely on the cryptographic strength of hash functions instantiated in the quantum random oracle model. SPHINCS+ achieves EUF-CMA security without reliance on structured hardness assumptions (lattice, code, or multivariate), supporting parameter sets suitable for 128-, 192-, and 256-bit classical security. Its design leverages a hierarchical composition of few-time and one-time signature schemes (FORS, WOTS+) and a multi-level Merkle hypertree to instantiate large numbers of ephemeral keys in a provably stateless fashion. While its parallelism and minimal security assumptions are notable, SPHINCS+ incurs significant performance and signature size overhead relative to lattice-based designs, motivating both aggressive parameter optimization and hardware- or architecture-specific acceleration research.

## 1. Core Structure and Algorithms

SPHINCS+ is built from three fundamental modules: FORS (Forest of Random Subsets), WOTS+ (Winternitz One-Time Signature Plus), and a hypertree structure comprising layers of Merkle trees.

- **FORS** is a few-time signature constructed from $k$ parallel binary hash trees of height $a$. Each tree signs a segment of the message digest by opening a path from the root to the leaf indexed by message bits. The FORS signature is the set of revealed leaves and corresponding authentication paths; the FORS public key is the hash-compression of all root nodes.

- **WOTS+** is a practical one-time signature using hash chains, parameterized by the Winternitz parameter $w$. For a hash output length $n$ and message length $\ell$, the chain depth and checksum amount are set to ensure $2^{n}$ security. Its hash functions are domain-separated via address and seed inputs.

- **Hypertree** is a $d$-layer construction, each layer being an XMSS Merkle tree with WOTS+ leaves. The hypertree attests the output of FORS, propagating the authentication through WOTS+ signatures and Merkle paths up to a global root.

Signatures ($\sigma$) consist of the randomness $R$, the FORS signature, and the set of WOTS+ signatures plus all Merkle authentication paths required to link the message to the public root.

**Signing** for message $M$ involves:

1. $R = \mathsf{PRF}(\mathrm{SK}_{\mathrm{prf}}, M)$  
2. $\hat{m} = H_{\rm msg}(\mathrm{PK}_{\rm seed}, \mathrm{PK}_{\rm root}, R, M)$  
3. $(\sigma_F, \mathrm{pk}_F) = \mathsf{FORS.Sign}(\mathrm{SK}_{\rm seed}, \mathrm{PK}_{\rm seed}, \hat{m})$  
4. $\sigma_{HT} = \mathsf{Hypertree.Sign}(\mathrm{SK}_{\rm seed}, \mathrm{PK}_{\rm seed}, \mathrm{pk}_F)$  
5. $\sigma = (R, \sigma_F, \sigma_{HT})$

**Verification** reconstructs the root via FORS and hypertree verification, accepting if this equals the public root.

The fully stateless architecture ensures that each signing invocation derives ephemeral keys on demand from seeds, eliminating side-channel and key-exhaustion risks [2107.11082].

## 2. Security Foundations and Quantum Analysis

The security of SPHINCS+ is based solely on the collision-resistance, one-wayness, and pseudorandomness of the underlying hash family. The primary proof model is the quantum random oracle model (QROM); reductions in the literature show that a successful forgery against SPHINCS+ with $q_H$ hash and $q_S$ signature queries can be reduced to either:

- Breaking the PRF underlying $\mathrm{SK}_{\rm prf}$
- Collision resistance in $\mathsf{H}_{\rm FORS}$ or hypertree hash (Merkle tree or WOTS+ one-time signature)
- Finding a forgery for the WOTS+ or FORS commit-and-authenticate layers

A detailed attack model incorporating quantum decoherence and imperfect parallelism, together with sharpened entropy-concentration inequalities, is provided in [2508.19250]. Key points:

- Quantum adversaries are modeled as $(\tau, q, k)$-quantum attackers with decoherence channel $\Gamma_{\tau_d}$, parallelization map $\Pi_k$, and QROM oracle.
- The success probability of a quantum attack decays exponentially with circuit depth and with only sublinear gains from $k$-processor parallelism due to decoherence-induced mixing.
- Improved entropy concentration (Lemma 5.2 and Theorem 7.1) reduces the collision bound constants for hash output length determination from 2 to 3, enabling a practical 15–20% reduction in hash output length and signature size for the same security level.

The optimized NIST Level 1 SPHINCS+ parameterization can target a 222-bit collision entropy (vs. 256 bits originally), yielding $\approx$6.7 KB signatures (vs. 8.0 KB) with no decrease in provable QROM security guarantee [2508.19250].

## 3. Parameter Sets, Hash Instantiations, and Variants

SPHINCS+ offers parameter sets tuned for different trade-offs:

- “f” (fast) variants: minimize signing/verification time at the cost of larger signatures.
- “s” (small) variants: reduce signature size with the expense of increased hash/computation calls.

Canonical choices use SHA-2, SHAKE256, or Haraka hash functions. Full interoperability with other XOFs (e.g., Streebog [1904.06525], algebraic expanders [2602.09882]) is possible as long as collision and preimage resistance are ensured.

**Key and signature sizes** (typical, SHAKE256):

| Variant    | Public Key | Private Key | Signature Size    |
|------------|------------|-------------|-------------------|
| 128f       | 64 B       | 128 B       | ~8 KB             |
| 128s       | 64 B       | 128 B       | ~17 KB            |
| 192f       | 64 B       | 128 B       | ~14 KB            |
| 192s       | 64 B       | 128 B       | ~30 KB            |
| 256f       | 64 B       | 128 B       | ~30 KB            |
| 256s       | 64 B       | 128 B       | ~63 KB            |
[2107.11082]

Alternative hash instantiations (Streebog in [1904.06525]; SL$_4(\mathbb{F}_p)$ in [2602.09882]) show close security correspondence with marginal performance degradation (5–8% for Streebog vs. SHA-2/SHAKE), and can enable algebraic soundness if quantum resistance of graph-walk collisions is desired [2602.09882].

## 4. Performance, Implementations, and Hardware Acceleration

Software implementations of SPHINCS+ exhibit high computational cost due to the volume of hash computations. For instance, on an ARM Cortex-M4 (STM32F407G):

- Key generation and signing: $\sim$10 minutes each (reference: $d=12, h=5, w=16$)
- Verification: fails due to unmanageable hashing volume
- Memory usage for the 128-bit set: within $192\,\mathrm{KB}$ SRAM, but with negligible headroom
- The underlying bottleneck: $\mathcal{O}(d\,h + d\,w + k\,w)$ hash compressions $\approx$2,000 per signature [2606.15744]

For lattice-based Dilithium, key generation overflows memory on embedded MCUs, while SPHINCS+ completes but is orders of magnitude too slow for real-time applications; only hardware/software code-sign partitioning promises practical performance. Platform-specific hardware-accelerated approaches (offloading SHAKE256 to hardware, Merkle tree engines) reduce per-signature latency from minutes to milliseconds [2606.15744].

Modern GPU implementations leverage the high parallelizability of FORS and WOTS+ layers:

- HERO-Sign [2512.23969] employs tree fusion, autotuning, and kernel-specific register/block specialization.
- Tree-fused FORS computation and adaptive compilation (PTX/native) elevate occupancy from 17–25% (baseline) to 35–64% (optimized).
- On NVIDIA RTX 4090, HERO-Sign yields $1.28\times$ to $3.13\times$ throughput improvement vs. baseline for 128f–256f parameters; kernel launch latency is reduced by up to $221\times$ using CUDA Graphs.

Comparative x86/ARM performance (mean for “fast” variants):

| Hardware           | Sign (ms) | Verify (ms) | Reference  |
|--------------------|-----------|-------------|------------|
| ARM M1 (128f)      |    14.50  |   0.871     | [2510.09271] |
| x64 (i7-1360P)     |     6.54  |   0.493     | [2510.09271] |
| AMD Ryzen 5800X    |     5.60  |   0.436     | [2510.09271] |

SPHINCS+ is one to two orders of magnitude slower than lattice-based Dilithium or Falcon for signing, and generates larger signatures. Verification is $\sim$10$\times$ slower than ECDSA at Level 1, converging to $\sim$1.5$\times$ at Level 5 [2510.09271]. In blockchain simulations, SPHINCS+ verification rates dominate overall block validation latency [2510.09271].

## 5. Parameter Optimization and Security Reductions

Advanced analysis of SPHINCS+ security under quantum attack models enables more efficient parameter selection:

- Quantum adversaries experience decoherence, limiting the actual advantage from parallel quantum processors: the attack success drops as $1/\sqrt{k}$ and with $e^{-t/\tau_d}$ for circuit time $t$ [2508.19250].
- Rényi entropy concentration inequalities (Lemma 5.2) improve bounds in setting the necessary hash output length for a given security level.
- For NIST Level 1, the optimized output length $b$ can be reduced from 256 bits to 214 bits (plus safety margin), yielding signature sizes of $\sim$6.7 KB (original: $8.0$ KB) [2508.19250].
- The table below summarizes the gain:

| Parameter         | Original (Level 1) | Optimized (Level 1) | Reduction |
|-------------------|-------------------|---------------------|-----------|
| hash length       | 256 bits          | 214 bits            | 16.4%     |
| signature size    | 8.0 KB            | 6.7 KB              | 16.3%     |

The new bounds, incorporating modeling of decoherence and parallelization limits, provide a methodology for tight yet resource-efficient SPHINCS+ deployment under realistic quantum threat models.

## 6. Alternative Hash Instantiations and Theoretical Extensions

SPHINCS+ allows arbitrary (collision-resistant, one-way) hash family instantiation, as shown by Streebog-based and algebraic hash function studies:

- **Streebog** [1904.06525]: Drop-in replacement for SHA-2/SHAKE. Benchmarking shows ≤8% signing and ≤5% verification time penalty, signature sizes and parameters unchanged.
- **Spinel (SL$_4(\mathbb{F}_p)$ hash)** [2602.09882]: Replaces all internal hashes with domain-separated non-backtracking walks in $SL_4(\mathbb{F}_p)$. This expands security assumptions from hash-oracle to expander-graph properties. Performance decreases by $10^3\times$ for signing, $10^2$–$10^3\times$ for verification, and signature size increases by 20–30%. Security proofs extend via direct reduction to the algebraic collision-resistance and the standard SPHINCS+ QROM analysis. Spinel demonstrates the flexibility and abstraction-level security possible in the SPHINCS+ framework.

## 7. Applications, Comparative Assessment, and Limitations

SPHINCS+ is suitable where minimal security assumptions (collision-resistant hashes), stateless operation, and high parallelism are required. Its main application contexts include PQ-safe digital signatures for software and embedded systems, blockchain protocols, and as a drop-in for cryptosystems phasing out ECDSA and other quantum-vulnerable primitives.

- **Strengths:** Well-studied security, hash-only assumptions, no state-management
- **Limitations:** Large signature size (4–65 KB typical), slower sign/verify (milliseconds–minutes without hardware acceleration), significantly outperformed by MLWE lattice schemes (e.g., Dilithium) in both performance and signature size

Current research emphasizes architectural optimizations for high-performance deployments, with hardware acceleration (FPGA, GPU) demonstrably converting SPHINCS+ from impractical to performant in throughput-sensitive systems such as public blockchains or embedded controllers [2606.15744, 2512.23969].

---
**References:**  
- [2107.11082]  
- [1904.06525]  
- [2508.19250]  
- [2510.09271]  
- [2512.23969]  
- [2602.09882]  
- [2606.15744]

Source: https://www.emergentmind.com/topics/sphincs