FIPS 205 — SLH-DSA

FIPS 205 specifies the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA), derived from SPHINCS+ and finalized on 13 August 2024. It is the most conservative post-quantum signature standard: its security rests only on the properties of hash functions.

Why SLH-DSA matters

ML-DSA and FN-DSA depend on the conjectured hardness of lattice problems. SLH-DSA makes no such assumption — its security rests primarily on the underlying hash function and the choice of security parameters, not on structural assumptions such as lattice problems. If a future cryptanalytic breakthrough weakened lattices, SLH-DSA would be unaffected. This makes it the natural choice for long-lived roots of trust where a decades-long security guarantee outweighs performance concerns. SLH-DSA has small public and private keys but very large signatures, which makes it better suited to low-frequency signing, long-term roots of trust, and firmware signing.

Building blocks

• WOTS+ (Winternitz One-Time Signature Plus) — a one-time signature scheme. Each WOTS+ key can sign exactly one message safely; signing involves hashing secret values a controlled number of times.
• FORS (Forest Of Random Subsets) — a few-time signature scheme used to sign the actual message digest, tolerating limited reuse so the hypertree need not be impractically deep.
• Hypertree — a tree of XMSS layers (themselves Merkle trees of WOTS+ keys). The hypertree authenticates the FORS keys up to a single small public key, while keeping the scheme stateless: a pseudorandom index selects which leaves to use, so no per-signature state must be tracked.

This is the key distinction from SP 800-208's stateful schemes: SLH-DSA is stateless, eliminating the catastrophic one-time-key-reuse hazard at the cost of larger signatures.

The 12 parameter sets

SLH-DSA offers 12 combinations: two hash families {SHA2, SHAKE} × three security levels {128, 192, 256} × two tradeoff variants {s = small signature, slower; f = fast signing, larger signature}.

Public keys are tiny (32/48/64 bytes), but signatures are large — from roughly 7.8 KB up to nearly 50 KB. The s/f tradeoff balances signature size against signing speed: "s" variants have a deeper, slower-to-sign hypertree producing smaller signatures, while "f" variants sign faster but emit larger signatures.

When to choose SLH-DSA

• Root certificates and trust anchors that must remain valid for 20+ years.
• Firmware and secure-boot signing where a tiny public key is embedded in hardware and signatures are infrequent.
• Any context where you want a security guarantee that does not rely on lattice assumptions — defense in diversity alongside ML-DSA.

Standards & references

• FIPS 205 (SLH-DSA) — the authoritative standard specified on this page.
• NIST SP 800-208 — the stateful hash-based contrast (LMS/XMSS).
• NIST PQC project — program background and related publications.
• Resources — full standards register