eprint.iacr.orgpaperThe Exact Bit Security of Hash-Based Signatures
The Exact Bit Security of Hash-Based Signatures is a 2026 IACR ePrint paper that analyses XMSS with 128-bit digests and SLH-DSA-128s in the random oracle model, with proofs formalised in Lean4. Strong unforgeability comes to 127 bits under most accounting modes but only 122 bits if just direct random oracle queries are counted. The authors give matching attacks, and show how resource accounting changes the result.
TL;DR Proves tight bit-security bounds, with matching attacks, for XMSS and SLH-DSA-128s in Lean4: 127 bits, or 122 under the strictest accounting.
Organisations named here
- Benedikt Wagner
- Emile Wambsgans
- Mikhail Kudinov
Technologies named here
- Lean4
- SLH-DSA-128s
- XMSS
- SLH-DSA
- Lean
Techniques named here
- Formal verification in Lean4
Related in other
eprint.iacr.orgpaperRerandomizable Garbling for Arithmetic Circuits
aseemshrey.inarticle