Two incompatible profiles
LEGACY_KECCAK
This profile reproduces the pinned
HashSigsRS commit 2d315dd4168804b7cbc51c51a1bf7ca27bf74140
construction byte for byte. Its
hash is Keccak-256 with the legacy 0x01 domain byte. It is not standardized
SHA3-256, whose domain encoding differs.
The five checked-in upstream vectors bind this compatibility claim. Legacy verification exists in the software reference implementation. There is no active legacy Keccak hardware verifier top.
HASHSIGS_SHA256_GENERIC_V1
This profile instantiates the same WOTS parameters with SHA-256. It is the active hardware-performance profile and owns the three 64-stage compression lanes, production signer, and fail-closed hardware verifier.
It is not key- or signature-compatible with LEGACY_KECCAK. Calling it
“generic” does not make its byte strings portable to another WOTS parameter set
or standard.
Boundary table
| Property | Legacy Keccak | SHA-256 generic v1 |
|---|---|---|
| Rust profile type | LegacyKeccak | HashSigsSha256GenericV1 |
| Stable profile name | LEGACY_KECCAK | HASHSIGS_SHA256_GENERIC_V1 |
| Hash padding | Legacy Keccak 0x01 | SHA-256 padding |
| Pinned upstream compatibility | Yes | No; deliberately incompatible |
| Production hardware signer | Compatibility engine exists, not performance top | Active 3×4 top |
| Production hardware verifier | No | Active 3×4 top |
| Software sign/verify | Yes | Yes |
Never add an automatic fallback that tries both profiles. A protocol must select one authenticated profile before parsing untagged bytes.