pqcstatus
Algorithm

XMSS / XMSS^MT: quantum risk, deadlines and replacements

Quantum-resistant

Stateful hash-based signatures (NIST SP 800-208), intended for firmware and software signing.

At a glance

Quantum riskQuantum-resistant
Used forDigital signature
Post-quantum algorithmYes

Positions and deadlines by authority

AuthorityPositionEffectiveScopeDetails
NSA (CNSA 2.0)Recommendedin forceall variantsCNSA 2.0 algorithm for software and firmware signing.

Sources

  1. SP 800-208 — Recommendation for Stateful Hash-Based Signature Schemes (LMS, XMSS) · NIST
  2. CNSA 2.0 Algorithms (Cybersecurity Advisory) · NSA (guidance)

Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.

Frequently Asked Questions

Is XMSS / XMSS^MT quantum-safe?

Yes. No known quantum attack breaks XMSS / XMSS^MT at the recommended parameter sizes.