Provable Security of SHA-256-Based LMS Revisited in the Ideal-Cipher Model

What it is

An ePrint preprint (2026/2624, received 24 October 2026, approved 26 October 2026) by Chun Guo, Hao Cheng, Bart Preneel and Meiqin Wang. It gives the first ideal-cipher-model (ICM) security analysis of the SHA-256-based LMS parameter sets LMS_SHA256_M32 and LMS_SHA256_M24. The authors state that the standards (IETF, NIST, ISO) do not give precise guarantees for these sets.

How it works

The Katz (SSR 2016) and Fluhrer (ePrint 2017/553) proofs treat the hash as a random oracle. SHA-256 and SHA-256/192 are actually (chopped) Merkle-Damgård constructions built on a blockcipher-based Davies-Meyer function. The authors use those structural properties to build forgery attacks against both parameter sets, which shows the random-oracle bounds do not carry over. The abstract does not give the attack complexities.

Their proofs cover "additive-Davies-Meyer abstractions" of the two schemes, not the real SHA-256 compression function.

Preconditions / Affected

The bounds, with B̂ the number of SHA-256 blocks processed in the scheme's internal hash calls and Γ̂ the number of SHA-256/192 calls:

• LMS_SHA256_M32: about 256 − log2(B̂) bits, valid when B̂ ≪ 2^128.
• LMS_SHA256_M24: about min{192 − log2(Γ̂), 256 − log2(B̂)} bits, valid when B̂ ≪ 2^128 and B̂·Γ̂ ≪ 2^192.

Both quantities grow with the amount of hashing the scheme does, so the guarantee depends on the workload and is not a fixed number.

Caveats

• The authors conclude both sets give a "moderate (yet not full)" level of security.
• This is a preprint with no peer-review venue listed.
• The proofs are for the abstracted construction, and the attacks are described only at abstract level on the fetched page. No concrete parameter recommendation, migration advice or practical break is stated.
• The authors note that the work is mostly symmetric-key cryptography, although the topic is a post-quantum signature.