Hasan İRİCE

Software Engineer
METU | Physics

[Furkan @furkanakal]

Post-Quantum Diaries | DAY 9: eXtended Merkle Signature Scheme (XMSS)

As we discussed yesterday, LMS established the framework for stateful hash-based signatures, but its security critically depends on the collision resistance of the underlying hash function. XMSS (eXtended Merkle Signature Scheme), standardized in RFC 8391 and FIPS 208, refines this model and improves scalability through multi-tree constructions.

WOTS+ and Bitmasking

LMS uses LM-OTS, derived from standard Winternitz one-time signatures. In standard WOTS, signing relies on plain hash chains:

x → H(x) → H(H(x))

This construction directly inherits the collision-resistance requirement of H.

XMSS replaces this with WOTS+, introducing bitmask hashing. At each step of the chain, a pseudorandom mask derived from a seed is XORed into the state before hashing:

x → H(x ⊕ r₁) → H(H(x ⊕ r₁) ⊕ r₂)

This randomization removes structural relations between hash chain inputs. As a result, the one-time signature security reduces primarily to second-preimage resistance rather than full collision resistance. Since second-preimage resistance is a weaker and more stable assumption, WOTS+ remains secure even if collision resistance degrades.

Randomized Merkle Tree Hashing

XMSS applies the same bitmasking principle to Merkle tree construction. Internal nodes are computed as:

Node = H((Left ⊕ rᵢ) || (Right ⊕ rⱼ))

This prevents multi-target collision attacks, where a single crafted collision could compromise many tree nodes simultaneously. The result is a Merkle structure with tighter provable security margins.
Scaling: XMSS^MT Hypertrees

A single XMSS tree of height h can sign 2^h messages. But constructing a tree with very large h is computationally impractical.

XMSS^MT solves this with hypertrees:
• Upper-layer trees sign the roots of lower-layer trees
• Only bottom-layer trees sign actual messages
• The signature becomes a stack of WOTS+ signatures and authentication paths across layers

This enables practically unbounded signing capacity while keeping key generation and signing efficient.
Like LMS, XMSS is stateful. The private key maintains an index that must never be reused. Reusing an index means reusing a WOTS+ key, which immediately compromises the private key.

This operational constraint remains the main barrier to general-purpose deployment. In practice, XMSS is best suited for high-assurance, low-frequency signing environments such as firmware signing, root CAs, and long-lived infrastructure keys.

---

Thanks for the read! Next Monday, we'll discuss SPHINCS+.

(VISUAL: Jose Raul Capablanca)

[Range @range_org]

Stablecoins run crypto.

Until now, tracking them was chaos.

Meet Range's Stablecoin Explorer - one explorer to track all stablecoins across 100+ chains and 20+ bridges.

Check it out 👇

[Andres Monty | range.org @aesmonty]

The Palantir for Stablecoins

Today, we launch the first real-time intelligence platform for stablecoins: an asset-centric multichain explorer, the largest attribution dataset, entity and blacklist feeds, and a risk API.

The brain tracking trillions of dollars onchain is here.

[Furkan @furkanakal]

The FHE Book 👀🔜

[Furkan @furkanakal]

We will chat with @yunusguerlek about ZK and FHE in @node_101’s live broadcast. 🖖

Don’t miss out!

[Furkan @furkanakal]

Fully Homomorphic Encryption (FHE) will soon be a hot topic, thanks to teams like @zama, @inconetwork, and @fhenix. Finding an FHE scheme hasn't been easy due to the noise growth problem, but in 2009, Craig Gentry introduced "bootstrapping" to solve it. Let's see how! 🧵

[arbnom @arbnom]

🚨 Dear stablenjoyers, are you ready for a weekly stablecoin report? Here is the very first version.

In this report, you will find:

- Total review of the stablecoin market and a breakdown by projects.
- Total breakdown of the stablecoin market by chains.
- The most attractive stablecoin yields.
- Important events and news from the last month.
- Amazing resources for more stablecoin information.
https://t.co/GPmHNQHX2N

Don't forget to subscribe for the next reports and leave feedback. And always enjoy stability.

[node101 @node_101]

Cosmos Workshop Ankara is entering to the atmosphere in 2 days 🌠

With @turkiyerustcom and @odtublockchain, start your @cosmos journey and become a part of interconnected blockchains with @cosmos_sdk 👩🏻‍🚀

📍Ankara, Turkey
📅20.04
⏰14.00 GMT+3

Details ⤵
https://t.co/4uDnfz06WH

[Hasan İRİCE @irice_hasan]

Bu Cumartesi günü @node_101, @odtublockchain ve @turkiyerustcom ile birlikte düzenlediğimiz Cosmos Workshop etkinliğine hepinizi bekliyoruz. Interchain Developer Academy'nin programını takip edeceğiz, Cosmos hakkında uygulamalı bir şeyler öğrenmek isteyenler kaçırmasın. :)

[node101 @node_101]

Looking to start your @cosmos journey 👀

Cosmos Workshop Ankara with @turkiyerustcom and @odtublockchain is here 🤩

Whether your knowledge level is, you will expand your knowledge and practice it 🎓

📍Ankara, Turkey
⏰14.00 GMT+3
📅20.04

Details⤵
https://t.co/4uDnfz06WH

[node101 @node_101]

Looking to start your @cosmos journey 👀

Cosmos Workshop Ankara with @turkiyerustcom and @odtublockchain is here 🤩

Whether your knowledge level is, you will expand your knowledge and practice it 🎓

📍Ankara, Turkey
⏰14.00 GMT+3
📅20.04

Details⤵
https://t.co/4uDnfz06WH

[Bahar Cetiner @baharcetiner_]

Tesadüfe bak, n ve 8 birleşince bu dillerde gece anlamına geliyormuş.

[Hasan İRİCE @irice_hasan]

@skinnycxre Bir Scipio Africanus çıkar bir yerlerden. :)

[Hasan İRİCE @irice_hasan]

It was a perfect workshop for me and also learned the existence of Wagmi React hooks in this workshop. And, they are great for people who does not enjoy the front-end stuff. Thank you very much. :) @eth_gunu

[Eda @edatweets_]

Someone opened an issue on github to say thank you for the workshop & I am exactly this emoji right now: 🫠

As a devrel (self proclaimed) these are the best moments <3

[Hasan İRİCE @irice_hasan]

Thank you very much, awesome hoodie btw! @CosmWasm #Cosmoverse2023

[CosmWasm @CosmWasm]

Giveaway prices were served!🥳🔥🔥
Congrats guys🙌

[CosmWasm @CosmWasm]

🌟🚀COSMOVERSE GIVEAWAY ALERT!🚀🌟

We're dropping an epic #giveaway for our incredible community at @CosmoverseHQ in Istanbul.🇹🇷

🔥Who's ready to rock this awesome limited edition hoodie?😍

We're not holding back - THREE of you will strut away in style!🏅

Deets below.
👇🧵

[Hasan İRİCE @irice_hasan]

@CosmWasm @CosmoverseHQ Awesome! @CosmoverseHQ

[Hasan İRİCE @irice_hasan]

@AwesomWasm @confio_tech @CosmWasm See you in Berlin! #AwesomWasm

[Hasan İRİCE @irice_hasan]

@hilalina Benim yaptığım şeyden çok daha iyi duruyor. Fffkfkkf Fransızca çalışmayalı çok oldu, dolayısıyla okurken önce çevirmeye çalıştım sanırım ben. :)
Finaller bitince Pierrot'yu okuyayım bir an önce.

[Hasan İRİCE @irice_hasan]

@hilalina Bu hangi kitap? Çok iyi çevirmişsin. Ben hâlâ mot à mot çeviriyorum sanırım, okurken özellikle Formée ile başlayan cümleyi İngilizceye 'formed from pleasure' diye çevirip buradan Türkçe nasıl yapardım acaba diye düşündüm.

[Hasan İRİCE @irice_hasan]

@omerr_yanar Mülahaza edilen çeşitli konuları da bu 850mg kafeine mi borçluyuz acaba?