Winternitz state and signing
Winternitz identities are post-quantum and hash-based, but they are stateful. Each approval consumes one signing position.
What the wallet tracks
- Current root or commitment.
- Current signing position.
- Next expected position.
- Whether an approval has been broadcast.
Burn-on-broadcast rule
Once the wallet broadcasts a Winternitz signature, treat that position as used. Even if the transaction fails, the signature material may be visible.
Safe signing flow
- Refresh the on-chain Winternitz state.
- Confirm the proposal and canonical preimage.
- Sign with the next unused position.
- Submit the transaction.
- Confirm state advancement.
Do not reuse one-time positions
Reusing a Winternitz position for different messages can weaken or destroy the security assumption for that identity.
Technical Winternitz state
Read the program-side state-management notes.