XMSS offers tighter security proofs than LMS (with bitmasks and tweakable hashes) at somewhat higher computational cost. Parameter sets combine SHA-256 or SHAKE with tree heights of 10, 16 or 20; XMSS^MT layers trees for up to 2⁶⁰ signatures. As with LMS, the signer must never reuse a one-time key, so state handling must be crash-safe and keys must not be duplicated.
In practice LMS sees more hardware and firmware deployment, while XMSS is used, for example, by German BSI-recommended profiles and some secure boot implementations. SLH-DSA removes the state at the cost of signature size.