SLH-DSA (FIPS 205)

SLH-DSA is the NIST-standardized stateless hash-based signature scheme derived from SPHINCS+. It relies on nothing but the security of its underlying hash function, giving it the most conservative security assumptions of any standardized PQC signature — at the cost of large signatures.

How it works

SLH-DSA is built entirely from hash functions (either the SHA-2 or the SHAKE/SHA-3 family) — no lattices, no number theory. Its security relies primarily on well-studied properties of the underlying hash functions, together with correct parameterization and implementation — making it a conservative, non-lattice alternative to lattice-based signatures. Its security reduces to standard security properties of the hash function; against quantum attacks the main consideration is the security-strength reduction from Grover search, which is why the parameters are sized for the corresponding security levels.

Internally it composes several hash-based building blocks: a few-time signature (FORS) signs a message digest, a one-time signature (WOTS+) authenticates intermediate keys, and a hypertree of Merkle trees binds everything to a single public key. Crucially, SLH-DSA is stateless: each signature picks its FORS instance pseudorandomly, so unlike XMSS/LMS the signer need not track any per-signature state. This eliminates the catastrophic key-reuse failure mode of stateful schemes.

Parameter sets

There are 12 parameter sets: hash family {SHA2, SHAKE} x security {128, 192, 256} x speed variant {s, f}. The s ("small") variant gives shorter signatures but slower signing; the f ("fast") variant signs faster but produces larger signatures. Public keys are tiny.

Public keys are 32, 48, or 64 bytes for the 128/192/256-bit security levels respectively.

Strengths & tradeoffs

• Most conservative security. Depends only on hash-function security — the best-understood primitive in cryptography. No new structured-lattice or coding assumptions.
• Stateless. No fragile per-signature state to manage, unlike XMSS/LMS. Tiny public keys.
• Tradeoff: signatures are very large (8-50 KB) and signing is comparatively slow. This makes it impractical for high-volume signing or bandwidth-constrained protocols, but ideal as a long-term root of trust.

When to use it

Reach for SLH-DSA when you want maximum confidence and signature size is not a bottleneck: root certificates, firmware/secure-boot anchors, and infrequently-issued long-lived signatures. It is an excellent hedge against a future cryptanalytic break of lattice schemes. The s variants produce smaller signatures but sign more slowly; the f variants sign faster but produce larger signatures. If transmission/storage cost matters more, prefer s; if signing latency matters more, prefer f.

Code example

import oqs

alg = "SLH-DSA-SHA2-128s"
message = b"root CA cross-signature"

with oqs.Signature(alg) as signer:
    public_key = signer.generate_keypair()  # public key ~32 bytes
    signature = signer.sign(message)         # signature ~7856 bytes
    print("pk bytes:", len(public_key), "sig bytes:", len(signature))

with oqs.Signature(alg) as verifier:
    print("valid:", verifier.verify(message, signature, public_key))

Standards & references

• FIPS 205 (SLH-DSA) — the official SLH-DSA standard.
• SPHINCS+ project — the design SLH-DSA is derived from.
• Open Quantum Safe — liboqs implementation used in the code example.
• Resources — full standards register

Related