<p>Yes, it uses a Winternitz OTS scheme. It is believed that Lamport signatures would still be secure against a quantum adversary.
No merkle signature scheme used with IOTA for transactions, as the result of a number of design and security decisions, for instance, signature size. It was a conscious decision to not use a stateless merkle scheme like sphincs. So yes, you should always transfer change to a new address. The implications of reusing a private key in a lamport scheme is that each reuse <a href="https://crypto.stackexchange.com/questions/2640/lamport-signature-how-many-signatures-are-needed-to-forge-a-signature">halves the security</a> level of the signature (assuming a random message).</p>

CC BY-SA 3.0
2017-08-23T19:40:09.530Z
So basically it boils down to: if i have two bitstrings of identical length, how many bits with same index (on average) will be different? Because for 
all those positions it is possible to spoof the signature bit in whatever way you want (for others just the exact value)
Probability of zero or one is 0.5 like with a coin toss. This means that for half of the indices we win. With 3 bitstrings the question is basically what is the probability I tossed 3 same results.  (0.5*0.5) and then for n (0.5)^(n-1). That is the unfavourable case and that the outcome played nice is then 1 - (0.5)^(n-1).
fiction
CC BY-SA 3.0
2017-08-23T19:48:23.177Z
Instead of solving it through protocol IOTA then relies on a "smart" client. I'd expect that the change is automatically returned to a newly generated address of mine? Not completely sure, what does it mean that an "address is attached to the tangle" (which happens when you generate a new address through the light client)? Isn't that something that can be done locally?
fiction
CC BY-SA 3.0
2017-08-23T19:51:36.227Z
Found https://www.reddit.com/r/Iota/comments/6jknwe/purpose_of_attaching_an_address_to_tangle/ already regarding "attachment".
fiction
CC BY-SA 3.0
2017-08-20T18:20:18.997Z
2017-08-20T18:20:18.997Z
Paul
<p>I've read a great deal about the impact of quantum computing on cryptocurrencies in:</p>

<ul>
<li><a href="https://github.com/theQRL/QRL/blob/master/QRL_whitepaper.pdf" rel="nofollow noreferrer">https://github.com/theQRL/QRL/blob/master/QRL_whitepaper.pdf</a></li>
<li><a href="https://bitcoin.stackexchange.com/questions/6062/what-effects-would-a-scalable-quantum-computer-have-on-bitcoin">What effects would a scalable Quantum Computer have on Bitcoin?</a></li>
<li><a href="https://bitcoinmagazine.com/articles/bitcoin-is-not-quantum-safe-and-how-we-can-fix-1375242150/" rel="nofollow noreferrer">https://bitcoinmagazine.com/articles/bitcoin-is-not-quantum-safe-and-how-we-can-fix-1375242150/</a></li>
</ul>

<p>IOTA also claims to be quantum resistant, unfortunately in their <a href="https://www.iotatoken.com/IOTA_Whitepaper.pdf" rel="nofollow noreferrer">whitepaper</a> that is just briefly mentioned in the last paragraph.</p>

<p>I believe they are talking about the impact from Grover's algorithm where doubling the bit-size help. I can't find any information on how they deal with signatures (which would be broken due to Shor's algorithm) however.</p>

<p>Their <a href="https://github.com/iotaledger/wallet/blob/96e847272c5e225d2656c1bf967b934e4d98f942/ui/index.html#L203" rel="nofollow noreferrer">wallet code</a> mentions:</p>

<blockquote>
  <p>You can use an address for receiving as long as you have not used it for any outgoing transaction. What this means is that once you have sent a transaction with a specific address as input, you should never use it again. This is because IOTA uses Winternitz one-time signatures which degrade security exponentially after each reuse.</p>
</blockquote>

<p>So I suppose they are using a <a href="https://www.cryptologie.net/article/306/one-time-signatures/" rel="nofollow noreferrer">Winternitz variant of Lamport's OTS scheme</a>. But how exactly? </p>

<p>I also found an interesting <a href="https://github.com/iotaledger/wallet/pull/105" rel="nofollow noreferrer">pull request</a></p>

<blockquote>
  <p>In order to prevent the reUse of adresses a message could be display to say that if you re-use the same adresses for transaction the security of your wallet will decrease quadratically .</p>
</blockquote>

<p>What does it mean that the "security of your wallet decreases quadratically"? Do they have some Merkele tree with keys to be used? Or how is the relation between address and public/private key in IOTA? If there can only be one transaction with a given input that somehow implies that you always have to transfer all funds?</p>

CC BY-SA 3.0
2017-09-27T15:28:40.447Z
You seem to be referencing the QRL whitepaper too. In that case, XMSS is being used.
Juan Leni
<quantum-computing><iota>
IOTA quantum resistance
fiction
# IOTA quantum resistance

(Asked by: username_0 on 2017-07-03)

I've read a great deal about the impact of quantum computing on cryptocurrencies in:

* <https://github.com/theQRL/QRL/blob/master/QRL_whitepaper.pdf>
* [What effects would a scalable Quantum Computer have on Bitcoin?](https://bitcoin.stackexchange.com/questions/6062/what-effects-would-a-scalable-quantum-computer-have-on-bitcoin)
* <https://bitcoinmagazine.com/articles/bitcoin-is-not-quantum-safe-and-how-we-can-fix-1375242150/>

IOTA also claims to be quantum resistant, unfortunately in their [whitepaper](https://www.iotatoken.com/IOTA_Whitepaper.pdf) that is just briefly mentioned in the last paragraph.

I believe they are talking about the impact from Grover's algorithm where doubling the bit-size help. I can't find any information on how they deal with signatures (which would be broken due to Shor's algorithm) however.

Their [wallet code](https://github.com/iotaledger/wallet/blob/96e847272c5e225d2656c1bf967b934e4d98f942/ui/index.html#L203) mentions:

> You can use an address for receiving as long as you have not used it for any outgoing transaction. What this means is that once you have sent a transaction with a specific address as input, you should never use it again. This is because IOTA uses Winternitz one-time signatures which degrade security exponentially after each reuse.

So I suppose they are using a [Winternitz variant of Lamport's OTS scheme](https://www.cryptologie.net/article/306/one-time-signatures/). But how exactly?

I also found an interesting [pull request](https://github.com/iotaledger/wallet/pull/105)

> In order to prevent the reUse of adresses a message could be display to say that if you re-use the same adresses for transaction the security of your wallet will decrease quadratically .

What does it mean that the "security of your wallet decreases quadratically"? Do they have some Merkele tree with keys to be used? Or how is the relation between address and public/private key in IOTA? If there can only be one transaction with a given input that somehow implies that you always have to transfer all funds?

**Tags:** quantum-computing, iota

> **Comments:**
> **username_1**: You seem to be referencing the QRL whitepaper too. In that case, XMSS is being used.  

---

## 1 answers

### Answer by username_2 on 2017-08-20. Score: 3 | Accepted answer

Yes, it uses a Winternitz OTS scheme. It is believed that Lamport signatures would still be secure against a quantum adversary.
No merkle signature scheme used with IOTA for transactions, as the result of a number of design and security decisions, for instance, signature size. It was a conscious decision to not use a stateless merkle scheme like sphincs. So yes, you should always transfer change to a new address. The implications of reusing a private key in a lamport scheme is that each reuse [halves the security](https://crypto.stackexchange.com/questions/2640/lamport-signature-how-many-signatures-are-needed-to-forge-a-signature) level of the signature (assuming a random message).

> **Comments:**
> **username_0**: So basically it boils down to: if i have two bitstrings of identical length, how many bits with same index (on average) will be different? Because for  all those positions it is possible to spoof the signature bit in whatever way you want (for others just the exact value) Probability of zero or one is 0.5 like with a coin toss. This means that for half of the indices we win. With 3 bitstrings the question is basically what is the probability I tossed 3 same results.  (0.5*0.5) and then for n (0.5)^(n-1). That is the unfavourable case and that the outcome played nice is then 1 - (0.5)^(n-1).  
> **username_0**: Instead of solving it through protocol IOTA then relies on a "smart" client. I'd expect that the change is automatically returned to a newly generated address of mine? Not completely sure, what does it mean that an "address is attached to the tangle" (which happens when you generate a new address through the light client)? Isn't that something that can be done locally?  
> **username_0**: Found https://www.reddit.com/r/Iota/comments/6jknwe/purpose_of_attaching_an_address_to_tangle/ already regarding "attachment".  

---

