# Post-Quantum Digital Signature: Verkle-Based HORST
## 5 Winternitz One-Time Signature Plus (WOTS+)  
A modified version of the original WOTS scheme, Winternitz One-Time Signature Plus (WOTS+) aims to preserve the fundamentals of hash-based signatures while enhancing security and efficiency. By using bitmasks to counteract attacks that take advantage of hash chain predictability, WOTS+ is more resilient to cryptographic attacks such as collision and second-preimage attacks [17]. The chaining process applies a more sophisticated function to link hash operations, replacing the straightforward iterative hashing utilized in WOTS. To ensure unique and unpredictable calculations, WOTS+ also uses a modified hash function, which can be either a bespoke hash function or a modified version of an existing one. Because of these improvements, WOTS+ is far more resistant to assaults that target WOTS's iterative structure.  
Similar to WOTS, WOTS+ depends on a Winternitz parameter \(w\) and a cryptographic hash function \(H\) (e.g., SHA-256), which determines the efficiency of the scheme. The secret key consists of \(l\) randomly generated values: \(\text{sk}=(\text{sk}_{1},\text{sk}_{2},\ldots,\text{sk}_{l})\).  
A modified hash chain with a bitmask \(r_{i}\) for every private key element is used to calculate the public key. Each public key element is specifically computed as follows:  
\[\text{pk}_{i}=H^{w-1}(\text{sk}_{i}\oplus r_{i})\text{ for }i=1,2,\ldots,l \tag{9}\]In this case, the bitmasks \(r_{i}\) are created at random, and \(\oplus\) indicates the XOR operation. These bitmasks serve as further protection, making the hash chains unpredictable and resilient to assaults.  
A message must first be hashed to provide a fixed-length digest before it can be signed. After that, this digest is transformed into base-w notation, yielding \(l\) sections: \(\text{msgDigest}=(\text{msgPart}_{1},\text{msgPart}_{2},\dots,\text{msgPart}_{ l})\).  
For every component \(\text{msgPart}_{i}\), the matching secret key element \(\text{sk}_{i}\) is XORed with the bitmask \(r_{i}\) and then hashed \(\text{msgPart}_{i}\) times:  
\[\text{sig}_{i}=H^{\text{msgPart}_{i}}(\text{sk}_{i}\oplus r_{i}) \tag{10}\]  
The final signature is formed of these \(l\) values: \(\text{signature}=(\text{sig}_{1},\text{sig}_{2},\dots,\text{sig}_{l})\).  
The bitmask is applied and each signature component is hashed up to \(w-1\) times in order to recover the public key during verification. The verifier calculates the following for each signature component, \(\text{sig}_{i}\):  
\[\text{computedPk}_{i}=\text{Hash}^{(w-1-\text{msgPart}_{i})}(\text{sig}_{i}) \oplus r_{i} \tag{11}\]  
The signature is deemed legitimate if the calculated public key corresponds to the original public key. This procedure guarantees that the signature is genuine and unaltered.  
Bitmasks have been added to the one-time signature approach WOTS+ to stop attackers from learning important details about the values of the private key, even in the case that several signatures are made public. Because of this, WOTS+ is more resistant to attacks that take advantage of hash chains' deterministic nature. In practice, WOTS+ is more efficient since it minimizes the number of hash function applications needed for key generation and verification. Since its architecture makes it less likely for an attacker to reconstruct the private key even if many signatures are seen, it also lowers the danger of key exposure while signing several messages.  
WOTS+ maintains its fundamental benefits, including small signature sizes and defense against quantum attacks, in spite of these enhancements. It is frequently used in combination with Merkle tree-based signature schemes, such as XMSS (Extended Merkle Signature Scheme), which preserve the quantum-resistant qualities of WOTS+ while enabling the secure chaining of numerous one-time keys to sign multiple messages.