Cool idea @jonasnick.
@niklaus I think Jonas is not suggesting necessarily that we should mix SLH-DSA with SPHINCS+C - just that either are options. His proposal is more about the structure: Combining two SPHINCS keys, one with low q_s as a primary, and one with high q_s as fallback.
@jonasnick I have a concern about your assumption here:
If we want to have efficient wallet standards which provide drop-in replacement for BIP32, this actually can’t be the case, since hash-based keys cannot be rerandomized. See this mailing list post.
If someday we are using hash-based signatures for everyday transactions (a pretty bleak future) then sure, this might hold - In that world, unhardened derivation wouldn’t exist, and every change and receiving address would use a fresh hardened child key.
However, for the purposes of providing fallback quantum security to some primary scheme like ECC, this probably would not hold.
How would you see SHRIMPS being used in that context?