hashsigs-rs

# hashsigs-rs

Core Rust hash-signature workspace with:

- `hashsigs-rs`: one crate containing:
  - `wotsplus` — the standalone WOTS+ one-time signature scheme (v1, legacy)
  - `sphincs_plus_c` — the stateless SPHINCS+C scheme
  - `shrincs` — the hybrid SHRINCS signer / verifier
  - `wasm` — verifier / signer bindings
- `solana/`: verify-only Solana program, plus an account-wrapper example at
  `solana/examples/shrincs-account/`
- `ts/`: `@quip.network/hashsigs-wasm`, the npm wrapper for the wasm build
- `py/`: the Python package scaffold (`hashsigs`). The binding API is under
  construction

This crate is the reference signer: it generates the golden vectors that
anchor the Solidity verifier in
[`hashsigs-solidity`](https://gitlab.com/quip.network/hashsigs-solidity).

## The SHRINCS construction

SHRINCS is a two-path hash-based signature construction
([ePrint 2025/2203](https://eprint.iacr.org/2025/2203), appendix). One
committed key bundle carries two verification paths with different costs and
budgets:

- **Stateful path (cheap, bounded).** A WOTS-C one-time signature under an
  unbalanced XMSS-style Merkle tree (UXMSS). Normal operations use this path.
  Each signature consumes one leaf, up to `maxSignatures` (at most 4,096).
- **Stateless path (expensive, break-glass).** A full SPHINCS+C signature: a
  FORS-C few-time signature carried up a hypertree of WOTS-C layers. Reserved
  for recovery and key rotation. Needs no signer state.

```mermaid
graph TD
    C["publicKeyCommitment (32 B)<br/>tag: shrincs-public-key/&lt;profile&gt;<br/>binds statefulPublicKey + pkSeed + hypertreeRoot"]
    C --> SR["Stateful root (UXMSS)<br/>unbalanced tree of WOTS-C one-time leaves<br/>leaf index = auth-path length"]
    C --> HR["Stateless root (SPHINCS+C)<br/>hypertree of WOTS-C layers<br/>over FORS-C few-time signatures"]
```

A 32-byte `publicKeyCommitment` binds both roots plus the profile identity.
Only the commitment needs on-chain storage. Callers resupply the full
164-byte public-key bundle on every verify, and the verifier recomputes and
checks the commitment. Verification is pure keccak-256 (SHA-256 for scheme
hashes in the sha2 profile) and grinds nothing. Signer state (nonces,
used-leaf tracking, budgets) belongs to the integrating account, not the
verifier.

### Components

Dependencies point only downward. Neither path knows about the other.
`shrincs` composes them at the API boundary.

- `shrincs` — the hybrid: commitment scheme, stateful + stateless dispatch,
  canonical action and rotation hashes.
- `shrincs::uxmss` — the stateful half: WOTS-C leaves under the unbalanced
  tree, crate-internal.
- `sphincs_plus_c` — the stateless half: FORS-C (`fors_c`) and the hypertree
  (`hypertree`). Oblivious to `shrincs`.
- `wots_c` — the shared WOTS-C target-sum chain walk, grind, and codec. Both
  paths bind it with their own domain tags. It calls into neither.
- `wotsplus` — standalone WOTS+ with checksum chains, the v1 wallet scheme.
  Not part of S