WOTS+ in this project

The security parameter is n = 32 bytes and the Winternitz base is w = 16. A 256-bit message digest becomes 64 hexadecimal digits. Three additional hexadecimal digits encode the checksum, producing 67 chains in total.

32-byte digest → 64 base-16 digits
checksum       →  3 base-16 digits
total          → 67 chain digits

For a message digit d, signing advances that chain from its private segment to position d. Verification advances the signature value from d to endpoint 15. Hashing the 67 endpoints produces the public-key hash.

Domain inputs

The pinned construction derives its function key, masks, and secret segments through domain-separated PRF inputs. The compatibility profile must retain the upstream byte order and legacy Keccak padding exactly. The SHA-256 profile uses the same WOTS parameters and logical domains but produces unrelated keys and signatures.

Fixed signer work

The fused SHA-256 private-seed signer computes the signature and corresponding public key together. Advancing every chain to its endpoint keeps the hardware work fixed and allows the signature value at the message digit to be captured along the way. The complete operation costs exactly 1,258 SHA-256 compression blocks.

Fixed work is an implementation property, not proof of side-channel safety. Memory addresses, enables, arbitration, reset behavior, physical placement, and power still require separate analysis.

Serialized profile identity

Keys and signatures contain no in-band profile tag. Store or authenticate the profile identifier next to every serialized value. Length is not a valid profile detector because both profiles use the same WOTS parameters.