LMS / XMSS
NIST SP 800-208Stateful hash-based signature schemes every authority that names them restricts to firmware and software signing, because losing track of signing state breaks their security.
Approved or recommended by
LMS SHA-256/192 preferred
Firmware and software signing only. Multi-tree variants HSS and XMSS^MT are not allowed.
“NSA has only approved LMS and XMSS for use in NSS. The multi-tree algorithms HSS and XMSS^MT are not allowed.”NSA CNSA Suite 2.0 and Quantum Computing FAQ (Dec 2024) →
Recommended only where signing state can be guaranteed, e.g. firmware and software updates.
BSI TR-02102-1, Version 2026-01 →Only applicable in specific scenarios that allow for careful state management.
The PQC Migration Handbook, 2nd edition (Dec 2024) →Relevant for contexts with a restricted maximum number of signatures and careful state storage, typically software updates.
ANSSI views on the Post-Quantum Cryptography transition (2023 follow-up) →For digitally signing firmware and software, per the CNSA 2.0 text it reproduces.
後量子密碼遷移指引 v1.00 (16 April 2025) →This page lists only jurisdictions we have researched and where a primary source names a position on LMS / XMSS specifically. Absence from this list is not evidence a country prohibits or ignores it -- see that country's page directly.