SHA-256 Based Signature Schemes Face New Security Attack
The identified second-preimage vulnerability reduces the security strength of specific hash-based signature methods.
Updated on Oct. 26, 2026 in Cybersecurity
Security researchers have identified a second-preimage attack targeting HSS/LMS and XMSS signature schemes that rely on SHA-256 and SHA-256/192. This vulnerability, which exists in research-stage, utilizes a variation of the Kelsey-Kohno herding technique to reduce the effective security strength of these cryptographic standards.
Why it matters
The findings reveal a fundamental weakness in how these schemes interact with the SHA-256 chaining state. Because this state is narrower than twice the security level, it enables a multi-target attack that could affect high-security digital signatures used in critical infrastructure.
The attack demonstrates a security loss of 100 bits for full SHA-256 and 39 bits for SHA-256/192, with an attack cost of 2^166 compression-function calls for 4 GiB messages. Unlike these configurations, the SHAKE256 parameter sets remain unaffected by the research findings.
The players
HSS/LMS
Hierarchical Signature System and Leighton-Micali Signatures are stateful hash-based digital signature schemes.
XMSS
The eXtended Merkle Signature Scheme is a stateful hash-based signature method designed for long-term security.
The details
The attack exploits SHA-256 internal chaining states—the intermediate values generated during the hash process—by collecting multiple signatures and pooling them across different keys to increase exposure. Researchers employed a Kelsey-Schneier expandable message, a construct that allows an attacker to manipulate internal states of long signed messages through state collisions. By merging these chaining states from various prefixes into a single target state, the attacker can force a second-preimage—finding a different input that results in the same hash output as a known legitimate message.
Timeline
October 25, 2026: Research paper publication.
The Tech Race
This finding challenges the current security assumptions of stateful hash-based signature schemes in the post-quantum transition. It marks a significant update to cryptanalytic efforts aimed at identifying vulnerabilities in signature standards before their widespread deployment in secure infrastructure.
Developers and security engineers should audit current systems for HSS/LMS or XMSS implementations using SHA-256 or SHA-256/192. Teams using SHAKE256 parameter sets are currently unaffected, though updating cryptographic policies to prioritize more resilient algorithms is recommended.
The takeaway
The research highlights a significant reduction in security strength for commonly used hash-based signatures. Security architects should review the academic paper on cryptanalysis to assess if their current implementations utilize the vulnerable SHA-256 parameter sets.
Further reading
For broader context on digital signature security, see the latest research in /tech/cybersecurity/.
More information
View the complete findings in the academic paper on cryptanalysis.
