pub fn digits_kernel(xof: [b8; 64]) -> [b2; 68]Expand description
68 digits from the 64-byte message XOF (low two bits, then checksum).
- Digits 0..64: the low two bits of each XOF byte (values 0..=3).
- Digits 64..68: the checksum
Σ (3 − d)over those 64 digits, written in base 4, low digit first. The maximum is 64 × 3 = 192, so it fits in 8 bits and four base-4 digits.
The checksum is what makes W-OTS+ safe: raising any message digit (which a forger could do by hashing further along a chain) lowers the checksum, and a lower checksum digit would need a chain to be walked backwards, which is infeasible. Combinational.