This is a simplified WOTS+ (Winternitz one-time signature) + Merkle tree scheme — the construction behind real standards like SPHINCS+ and XMSS. Its only security assumption is that the hash function is one-way and collision-resistant, so it has no algebraic structure for Shor's algorithm to attack, unlike RSA/ECC or even lattice/code-based schemes.
Private key: n random seeds s_0 … s_(n-1)
One chain: pk_i = H^(w-1)(s_i) (hash applied w-1 times)
Sign digit d: reveal σ_i = H^d(s_i) (climb only d hops up the chain)
Verify: H^(w-1-d)(σ_i) =? pk_i (finish the climb, compare)
Each of the n chains signs one base-w digit of the message hash — a larger w means fewer chains but each hop reveals more of the private chain. The n chain-top hashes are combined into one leaf, and a Merkle tree of height h compresses 2h leaves (one OTS keypair each) into a single public root — that root, not any chain, is the actual public key. A signature attaches the revealed chain values plus the authentication path (h sibling hashes) so a verifier can recompute the root. The diagram below draws that flow top-to-bottom: seeds climb into chains, the current chain-tops feed one leaf, and the leaf climbs the tree to the root.
- Sign message — hashes the text into n digits, climbs each chain to the reveal point, and lights the authentication path from the next unused leaf to the root.
- w selector — trades signature size against hash-chain length (larger w = shorter signature, more hashing).
- Tree height h — how many one-time keypairs (2h) the public root can authenticate before keys run out.
- Force leaf reuse — a WOTS+ chain is a one-time signature by design. Signing two different messages with the same leaf reveals two different points on each chain; the segment between them is now public, and an attacker who controls a message can often forge a signature by choosing digits that only need already-revealed hops. The chains at risk turn red.
- Drag to pan, scroll/pinch to zoom — the chains and the full 2h-leaf tree rarely fit at one scale; the diagram is a real pannable/zoomable camera, not a fixed picture.
Real deployments (SPHINCS+) avoid the "one leaf only" fragility by hashing a huge virtual tree of trees so no leaf is ever reused, at the cost of larger signatures (~8–50 KB) — the trade-off this simulator's size/ops readouts are meant to make tangible.