hashsigs-solidity

# Hash-Based Solidity Verifier Implementations

Verifier-oriented Solidity implementations of hash-based signature
schemes: the WOTS+ one-time signature scheme and the SHRINCS hybrid
stateful/stateless construction.

The production contracts in [`contracts/`](./contracts/) cover on-chain
verification only. Signer-side recovery state, seed restore logic, and
wallet lifecycle management are out of scope; test-only Solidity signer
helpers live under [`test/helpers/`](./test/helpers/) and are not
deployable.

## Implementations

Citation keys follow [CODINGSTANDARDS.md §1](./CODINGSTANDARDS.md).

- **WOTS+** ([contracts/WOTSPlus.sol](./contracts/WOTSPlus.sol)) — the
  Winternitz one-time signature scheme `[WOTSPLUS]` (A. Hülsing,
  *W-OTS+: Shorter Signatures for Hash-Based Signature Schemes*,
  AFRICACRYPT 2013; <https://eprint.iacr.org/2017/965>). Keccak-256,
  32-byte hashes and messages, Winternitz parameter `w = 16`, 67 chains
  (64 message + 3 checksum). Standalone, with no SHRINCS dependency.
  The public API (`verify`, `verifyWithRandomizationElements`, `sign`,
  `generateKeyPair`, `generateRandomizationElements`, `chain`, and the
  public constants) is stable and vector-tested; the signer-side
  helpers are reference code, documented "do not use on-chain."
- **SHRINCS** ([contracts/SHRINCS.sol](./contracts/SHRINCS.sol) and its
  component libraries) — the hybrid stateful/stateless hash-based
  construction by Kudinov and Nick `[SHRINCS]`, specified in the
  appendix of *Hash-based Signature Schemes for Bitcoin*, Cryptology
  ePrint Archive 2025/2203 (<https://eprint.iacr.org/2025/2203>).
  Compiled per profile (see [Profiles](#profiles)):
  - `256s` (default) — keccak-256, 32-byte hashes, `h = 64`, `d = 8`,
    `a = 14`, `k = 22`, 64 WOTS-C chains, 2^20 stateless budget.
    Reviewed and anchored to Rust-generated signature vectors.
  - `128s-q18` (experimental) — 16-byte truncated hashes, single-layer `h = 18`
    hypertree, `a = 24`, `k = 6`, 32 WOTS-C chains, 2^18 stateless
    budget. Anchored to Rust-generated signature vectors; the stateless
    path is verified against them by `SHRINCSSphincs128sVectors`.
  - `128s-q20` (experimental) — as `128s-q18` with a 2^20 stateless budget; shares the
    128s vectors except the profile-bound commitment.
- **SPHINCS+C** ([contracts/SPHINCSPlusC.sol](./contracts/SPHINCSPlusC.sol))
  — the stateless SPHINCS+C construction `[SPHINCSPLUSC]` (M. Kudinov,
  A. Hülsing, E. Ronen, E. Yogev, *SPHINCS+C: Compressing SPHINCS+ With
  (Almost) No Cost*, Cryptology ePrint Archive 2022/778, IEEE S&P 2023;
  <https://eprint.iacr.org/2022/778>). SHRINCS uses it as the stateless
  recovery path: a `FORS-C` few-time signature carried up a hypertree of
  `WOTS-C` layers to the public root. Deployed per profile as
  `SPHINCSPlusC256sKeccak`, `SPHINCSPlusC128sQ18Keccak`, and
  `SPHINCSPlusC128sQ20Keccak`; each SHRINCS verifier delegates its
  stateless path to the matching profile sibling.

## What SHRINCS Is

SHRINC