XMSSMT

As explained in Real-World Cryptography

XMSSMT is a multi-tree variant of XMSS that limits signing-time regeneration to the trees along an authentication path.

XMSSMT is a multi-tree form of XMSS: smaller Merkle trees form a hypertree, and one-time signatures sign the roots of other trees. This increases supported signatures while limiting regeneration work to trees on the signing path. section 14.2.3

The design balances signature capacity, signing work, and operational risk:

• A hypertree connects multiple Merkle trees, with one-time signatures in lower-level leaves signing higher-level tree roots. section 14.2.3
• Only trees along the path to the selected one-time signature are deterministically generated when needed. section 14.2.3
• XMSSMT remains stateful: reusing a signing path through rollback or multiple servers can reuse a one-time signature and enable forgery. section 14.2.3

Figure 14.6 The XMSS^MT stateful hash-based signature scheme uses multiple trees to increase the amount of signatures supported by the scheme while reducing the work at key generation and signing time. Each tree is deterministically generated only when they are used in the path to the final leaf that contains the OTS used to sign a message.

The diagram shows how multiple deterministically generated trees reduce key-generation and signing work. section 14.2.3

How Real-World Cryptography covers it

How deep it goes

Explains the hypertree and selective regeneration, then stops short of implementation-level construction details.

Examples

Illustrates XMSSMT with a hypertree diagram showing deterministic generation along the path to a signing leaf.

What it assumes

Assumes familiarity with one-time signatures and Merkle trees while explaining their combination into a hypertree.

What you can do after

Evaluate/understand XMSSMT’s regeneration tradeoff and the operational consequences of its statefulness.

How it connects

Connects one-time signatures, Merkle trees, XMSS, stateful signatures, and SPHINCS+.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• sphincs+implemented by · SPHINCS+ is a stateless hash-based digital signature scheme built from XMSSMT and few-time signatures.
• XMSSkind of · XMSS is a stateful hash-based signature scheme that organizes one-time signatures under a Merkle tree and derives their private keys from a seed.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.