해시 기반 서명의 Verifier-centric Solidity 구현 계획: WOTS+ 일회 서명 계획 및 SHRINCS 잡종 stateful/stateless 건축.

contracts/]에 있는 생산 계약은 사슬을 덮습니다 인증번호 Signer-side Recovery state, 씨앗 복원 논리, 과 지갑 Lifecycle 관리는 범위에서 있습니다; 시험 전용 Solidity signer helpers 살고있다 아래의 test/helpers/ 과 아니 배포 가능.

구현

인용 열쇠는 CODINGSTANDARDS.md §1를 따릅니다.

• WOTS+ (contracts/WOTSPlus.sol) - Winternitz 원시 서명 계획 [WOTSPLUS] (A. Hülsing, W-OTS+: Hash-Based Signature Schemes에 대한 짧은 서명, AFRICACRYPT 2013; ). Keccak-256, 32 바이트 해헤와 메시지, Winternitz 매개 변수 w = 16, 67 체인 (64 메시지 + 3 체크섬). 독립, SHRINCS 의존성 없이. 공개 API (verify, verifyWithRandomizationElements], sign], generateKeyPair, generateRandomizationElements, chain], public constants)는 안정적이고 벡터 테스트; signer 측 helpers are reference code, documented “에 체인을 사용하지 마십시오.”
• SHRINCS (contracts/SHRINCS.sol 및 그

Hash-Based Solidity Verifier Implementations

Verifier-oriented Solidity implementations of hash-based signature schemes: the WOTS+ one-time signature scheme and the SHRINCS hybrid stateful/stateless construction.

The production contracts in contracts/ cover on-chain verification only. Signer-side recovery state, seed restore logic, and wallet lifecycle management are out of scope; test-only Solidity signer helpers live under test/helpers/ and are not deployable.

Implementations

Citation keys follow CODINGSTANDARDS.md §1.

• WOTS+ (contracts/WOTSPlus.sol) — the Winternitz one-time signature scheme [WOTSPLUS] (A. Hülsing, W-OTS+: Shorter Signatures for Hash-Based Signature Schemes, AFRICACRYPT 2013; ). Keccak-256, 32-byte hashes and messages, Winternitz parameter w = 16, 67 chains (64 message + 3 checksum). Standalone, with no SHRINCS dependency. The public API (verify, verifyWithRandomizationElements, sign, generateKeyPair, generateRandomizationElements, chain, and the public constants) is stable and vector-tested; the signer-side helpers are reference code, documented “do not use on-chain.”
• SHRINCS (contracts/SHRINCS.sol and its component libraries) — the hybrid stateful/stateless hash-based construction by Kudinov and Nick [SHRINCS], specified in the appendix of Hash-based Signature Schemes for Bitcoin, Cryptology ePrint Archive 2025/2203 (). Compiled per profile (see Profiles):
  • 256s (default) — keccak-256, 32-byte hashes, h = 64, d = 8, a = 14, k = 22, 64 WOTS-C chains, 2^20 stateless budget. Reviewed and anchored to Rust-generated signature vectors.
  • 128s-q18 (experimental) — 16-byte truncated hashes, single-layer h = 18 hypertree, a = 24, k = 6, 32 WOTS-C chains, 2^18 stateless budget. Anchored to Rust-generated signature vectors; the stateless path is verified against them by SHRINCSSphincs128sVectors.
  • 128s-q20 (experimental) — as 128s-q18 with a 2^20 stateless budget; shares the 128s vectors except the profile-bound commitment.
• SPHINCS+C (contracts/SPHINCSPlusC.sol) — the stateless SPHINCS+C construction [SPHINCSPLUSC] (M. Kudinov, A. Hülsing, E. Ronen, E. Yogev, SPHINCS+C: Compressing SPHINCS+ With (Almost) No Cost, Cryptology ePrint Archive 2022/778, IEEE S&P 2023; ). SHRINCS uses it as the stateless recovery path: a FORS-C few-time signature carried up a hypertree of WOTS-C layers to the public root. Deployed per profile as SPHINCSPlusC256sKeccak, SPHINCSPlusC128sQ18Keccak, and SPHINCSPlusC128sQ20Keccak; each SHRINCS verifier delegates its stateless path to the matching profile sibling.

What SHRINCS Is