george0papasotiriou/cve-2026-22001-sphincs-wots-weak-randomness-forgeable-signatureDemonstrates a critical SPHINCS+ WOTS+ signature forgery caused by weak randomness and nonce reuse, recovering secrets from two (r,s) signature pairs.
An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recover the private key and forge arbitrary messages.
k for each signature. Reuse of k leaks algebraic relationships that reveal the seed.Run the simulation:
python sphincs_forge.py
python exploit_sphincs_forge.py
The output indicates weak signatures are produced. A real attacker would compute the private key using two (r,s) pairs with the same k.