New paper shows how bit-security accounting shifts hash-based signature security

StefanoGogioso · x · 2026-11-05

A paper by Mikhail Kudinov et al. gives exact definitions of bit security, showing that depending on how you account for an adversary's work, hash-based signature schemes have slightly but noticeably different security levels, with implications for Lean proofs and statements. Commenters note we often hand-wave hash-based signature security as that of the underlying hash function, though the schemes aren't practically insecure.

Original post →

More from Safety

Safety channel →