# Post-Quantum Digital Signature: Verkle-Based HORST
## 7 HORS: Hash to Obtain a Random Subset Signature Scheme  
A few-times signature (FTS) technique called HORS (Hash to Obtain a Random Subset) makes it possible to sign several messages with a single key pair, guaranteeing efficiency and security. It is appropriate for applications where some key reuse is acceptable but complete reusability is not necessary since it allows a certain number of signatures before key exposure becomes a danger. Since HORS does not rely on number-theoretic hardness assumptions like RSA or elliptic curve encryption, it is post-quantum secure. It must be used carefully, though, and is not completely reusable.  
HORS is based on a cryptographic hash algorithm that generates outputs with a defined length. The total number of secret key components (t) and the number of elements chosen from the secret key during signing (k) are the two main factors that determine the scheme's security and effectiveness [20].  
The signer generates t random secret values, which make up the private key, in order to produce the key pair. Our secret key is \(\mathrm{sk}\ =(\mathrm{sk}_{1},\ \mathrm{sk}_{2},\ldots,\ \mathrm{sk}_{t})\).  
The public key, which is made up of t hash values, is then generated by hashing each value of the secret key. Our public key is \(\mathrm{pk}_{i}=H(\mathrm{sk}_{i})\) for \(i=1,2,\ldots,t\).  
When verifying a signature, the verifier refers to the public key. The number of signatures needed and the desired security level are taken into consideration when selecting the parameters t and k. A greater t, for instance, boosts security but also makes the public key and signature larger.  
To generate a signature, the signer must first calculate a message digest using a cryptographic hash function \(\mathrm{msgDigest}\ =H(\mathrm{message})\).  
Next, the message digest is split into \(k\) segments, where each part is converted as an index value that selects one of the secret key elements. These indexes are computed: \((\text{index}_{1},\text{index}_{2},\dots,\text{index}_{k})=\text{msgDigest}\, \text{mod}t\).  
Once the indexes are determined, the signer includes the corresponding secret key elements in the signature: \(=\big{(}\text{sk}_{\text{index}_{1}},\text{sk}_{\text{index}_{2}},\dots,\text {sk}_{\text{index}_{k}}\big{)}\).  
It is safe for restricted usage since each signature only reveals a portion of the secret key. However, an attacker may be able to reconstruct the key and fabricate signatures if enough private key elements are exposed after several signatures. HORS is categorized as a few-times signature scheme instead of a fully reusable one because of this.  
Using the same method as the signer, the verification procedure starts by calculating the message digest \(\text{msgDigest}\,=H(\text{message})\). Similar to the signature procedure, the digest is then divided into k indexes: \((\text{index}_{1},\text{ index}_{2},\dots,\text{ index}_{k})=\text{msgDigest}\, \text{mod}t\).  
The verifier calculates the hash of each disclosed signature component and determines if it corresponds to the matching item in the public key:  
\[H(\text{sig}_{i})=\text{pk}_{\text{index}_{i}}\forall i\in[1,k] \tag{18}\]  
The signature is accepted if all of the hashes match; if not, it is denied. This procedure guarantees that the signature is genuine and unaltered.  
HORS is perfect for secure boot, firmware upgrades, and blockchain transactions since it permits numerous signatures from a single key pair and minimizes signature size by including just a portion of the private key [21]. However, after several signatures, there is a chance of fabrication since each signature reveals a portion of the secret key. In order to reduce key exposure, HORST (HORS with Trees) can incorporate a Merkle tree structure. Because of their ease of use and effectiveness in applications that need minimal signatures, HORS and its variations are commonly employed.