# Post-Quantum Digital Signature: Verkle-Based HORST
## 4 Winternitz One-Time Signature (WOTS)  
The Winternitz One-Time Signature (WOTS) scheme is a one-time signature technique that preserves security while reducing the number of public keys and signatures. It solves the shortcomings of the Lamport-Diffie OTS, which necessitates a significant amount of key storage and hash calculations. WOTS reduces the number of important components by grouping message bits together and using iterative hashing. It is still a one-time signature technique, though, so each pair of keys may safely sign just one message.  
The cryptographic hash function \(H\) that generates fixed-length outputs is the foundation of WOTS. The Winternitz parameter \(w\), which controls the number of bits that are joined together during signing, is another parameter introduced by the system. The signature gets shorter as \(w\) increases, but this comes at the expense of more hash calculations [16].  
The signer first produces \(l\) secret key components, where \(l\) depends on the value of \(w\) that is selected, in order to generate the key pair. These values are confidential and chosen at random: \(\text{sk}=(\text{sk}_{1},\text{sk}_{2},\ldots,\text{sk}_{l})\).  
The corresponding public key is obtained by applying the hash function iteratively \(w-1\) times on each secret key element: \(\text{pk}_{i}=\text{Hash}^{(w-1)}(\text{sk}_{i})\) for \(i=1,2,\ldots,l\). Here, \(H^{w-1}\) denotes applying the hash function \(w-1\) times (e.g., \(H^{2}(x)=H(H(x))\)).  
The first step in signing a message is hashing it to create a fixed-length digest. The digest is then expressed in base-w notation, where each hash digit indicates the number of times a matching secret key element has to be hashed. The message digest is broken up into \(l\) sections: \(\text{msgDigest}\ =(\text{msgPart}\ _{1},\ \text{msgPart}\ _{2},\ldots,\ \text{msgPart}\ _{l})\).  
For each part \(\text{msgPart}_{l}\), the signer takes the corresponding secret key element \(\text{sk}_{i}\) and hashes it to produce the signature component \(\text{sig}_{i}=H^{\text{msgPart}_{i}}(\text{sk}_{i})\).  
The final signature composed of all \(l\) values is signature \(\ =(\text{sig}_{1},\text{sig}_{2},\ldots,\text{sig}_{l})\).  
By hashing every component of the signature until the desired number of iterations is reached, the verifier reconstructs the public key. The verifier computes the following:  
\[\text{computed}\text{PK}_{i}=H^{w-1-\text{msgPart}_{i}}(\text{sig}_{i}) \tag{8}\]  
The signature is deemed legitimate if the calculated public key corresponds to the original public key.  
Because WOTS groups bits and requires fewer key pairs than Lamport-Diffie OTS, it is a one-time signature system that drastically decreases the amount of signatures. However, because of repeated hashing, this comes at the expense of more computing complexity. WOTS is unable to sign several messages safely without exposing its keys. Winternitz One-Time Signature Plus, or WOTS+, was created as an enhanced version to get around these restrictions and provide better security and efficiency.  
The Winternitz parameter w is chosen by carefully weighing security, computational cost, and signature size. The procedure is sped up when w is small since fewer hash calculations are needed for signing and verification. Conversely, the signature size dramatically shrinks when w is big, but the computing complexity rises as a result. The use case determines the ideal value of w, which strikes a balance between the requirement for compact signatures and the processing power at hand.  
By adopting a more secure hash function, a chaining method rather than simple iterative hashing, and a lower risk of key exposure while signing multiple messages, WOTS+ overcomes some of the drawbacks of the original approach. With these enhancements, WOTS+ retains the major advantages of the original WOTS scheme while being a more reliable and effective option for applications needing post-quantum secure signatures.