Are there any Winternitz alternatives out there which on the one hand make quantum computer attacks hard and on the other hand don't mess with the ability to reuse an address? Or are these properties mutual exclusive? (I can't assess this because I am not a crypto expert)

IOTA uses Winternitz one-time signatures to be more resilient to quantum computer attack vectors. The (in my opinion) very significant downside is the address reuse problem. It forces me to keep an address as a secret which does not feel right.

If for example someone knows my deposit address on Bitfinex he/she can send Iota to this address before or at the same time as me and I may loose my money because the exchange states: "After the first use of a deposit address, subsequent deposits to the same address will not be credited."

While this example may sound constructed it should illustrate the in my opinion questionable design decision of Winternitz usage in Iota.

You win on the security side by being more resilient to an attack vector which is not present as of today but you loose big times by having problems with address reuse which are very real if you think about the huge reclaiming issue.

I guess the whole address reuse issue may be one of the reasons why exchanges are hesitant to list IOTA if you think about the support tickets which arise by users reusing their deposit addresses.

  • The address reuse problem will only be an issue in IOTAs early days: How to avoid address reuse with automatic snapshots?
    – Zauz
    Jan 12, 2018 at 17:31
  • When you have Iotas on an exchange, you don't own the address and you should not communicate this address to anyone.
    – ben75
    Jan 12, 2018 at 19:22

2 Answers 2


Post-quantum cryptography is a fairly young field, and while there may be post-quantum signature schemes that are not one-time signatures, I don't know of any (feel free to correct me here).

A method to create "reusable" signatures from one-time signatures is the "Merkle signature scheme", which is also used by the Coordinator to sign its milestones. The disadvantage of that scheme is that you still need to specify an upper bound how often you want to sign with your key pair, and creation of a keypair is computationally expensive - noticably slower than single Winternitz signatures (and gets slower if you choose a higher upper bound).


Just to clarify you are not forced to keep the addresses as secrets.

Anytime somebody has to pay you, he/she has to ask you an address and you have to give him/her a new one.

The problem arises in case someone pays you on an address you already used to pay someone else.

So the only downsize of using quantum resistant Winternitz OTS is that the payers have always to ask to the receivers the address to be used for the payment.

  • If some evil guy gets hold of my current Bitfinex deposit address before I have started a deposit my money could be lost if his transaction gets confirmed before mine. Jan 12, 2018 at 18:46
  • @JupiterJones What dou you mean with "get hold your Bitfinex deposit"? Did he steal your Bitfinex user/password? In this case there isn't any algoritm preserving you.
    – blockmined
    Jan 12, 2018 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.