Post-quantumRecommended
SLH-DSA (FIPS 205)
Post-quantum stateless hash-based signatures
How it works
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) is derived from SPHINCS+. Its security relies only on the properties of hash functions, which are well understood, rather than on newer mathematical problems. Unlike older hash-based schemes it is stateless, so the signer does not have to track which one-time keys have been used.
Sizes: Parameter sets built on SHA-2 or SHAKE at 128, 192 and 256-bit security, in small (s) or fast (f) variants
Status: Finalised by NIST in August 2024 as a conservative backup to ML-DSA.
Strengths
- Conservative security assumptions (hash functions only)
- Stateless, avoiding the key-reuse risk of stateful hash-based signatures
Weaknesses and known attacks
- Signatures are large and signing is slow compared with ML-DSA
Use it for
- High-assurance, low-volume signing where conservative security matters more than size
Don't use it for
- High-volume or bandwidth-constrained signing where ML-DSA fits better
- Key exchange
Exam tip
SLH-DSA is the hash-based backup to the lattice-based ML-DSA, so a flaw in lattice maths would not break both.