What Is It?
SLH-DSA (Stateless Hash-based Digital Signature Algorithm) is a NIST-standardized post-quantum signature algorithm, published as FIPS 205 in August 2024. It is based on SPHINCS+, a stateless variant of the XMSS (eXtended Merkle Signature Scheme) approach to hash-based signatures.
SLH-DSA's security relies entirely on the security of cryptographic hash functions SHA-2 or SHA-3, depending on the parameter set selected. It has no dependence on algebraic assumptions (lattices, codes, or discrete logarithms). This makes it the most conservative choice among the NIST-standardized post-quantum signature algorithms.
NIST positions SLH-DSA as a backup to ML-DSA. In most deployments, ML-DSA is the primary signature algorithm; SLH-DSA provides algorithm diversity in case future cryptanalysis weakens lattice-based assumptions.
Why Does It Matter?
Cryptographic algorithm confidence is never absolute. ML-DSA is based on the hardness of lattice problems, a well-studied but relatively recent area of cryptography. SLH-DSA is based on SHA-2 and SHA-3, which have undergone decades of public analysis and have no known structural weaknesses. If a future breakthrough weakened lattice-based assumptions, SLH-DSA would remain secure.
Deploying SLH-DSA alongside ML-DSA provides algorithm diversity: if one family is weakened, the other continues to provide security. NIST and NSA CNSA 2.0 both cite algorithm diversity as a design goal of the post-quantum migration. Using only lattice-based algorithms concentrates the portfolio on a single mathematical foundation.
Hash functions have no known quantum speedup beyond Grover's algorithm, which approximately halves effective security. SLH-DSA uses SHA-256 or larger, providing at least 128-bit post-quantum security. This security reduction is well-understood and manageable by design.
How It Works
SLH-DSA is a stateless hash-based signature scheme built on Merkle trees of one-time signature keys. The stateless design eliminates the key-state management burden of earlier hash-based schemes like XMSS and LMS.
The algorithm uses FORS (Forest of Random Subsets) trees to achieve statelessness meaning the signer does not need to track which one-time keys have been used. The signing process:
Key selection
A pseudorandom function selects a one-time signing key from a large but deterministic tree structure, driven by the message and a random value.
Message signing
The message hash is signed with the selected one-time key. The one-time key is ephemeral it is derived fresh for each signing operation.
Authentication path
A Merkle authentication path is produced from the one-time key to the root public key. The verifier uses this path to confirm that the one-time key is authorized under the known public key.
Enterprise Impact
SLH-DSA's primary limitation is signature size. A SLH-DSA-SHA2-128f signature is approximately 17 KB, compared to 2.4 KB for ML-DSA-44 and 64 bytes for ECDSA P-256. This makes SLH-DSA unsuitable for protocols with tight message-size constraints.
Appropriate use cases for SLH-DSA:
Root CA signing
Offline, infrequent, high-value. Root CA signatures are not size-constrained. Signing a root certificate with SLH-DSA provides the most conservative security foundation for the entire PKI hierarchy.
Long-lived firmware signing
Devices with 10+ year lifetimes signed once at manufacture. The signature is stored on device and verified infrequently; size is acceptable.
Regulatory archives
Signed records requiring decades of verifiability. The conservative security foundation of SLH-DSA is well-suited to long-lived archive integrity requirements.
Algorithm diversity deployments
Any environment that requires both lattice-based and hash-based algorithm coverage. Deploying ML-DSA as primary and SLH-DSA for offline or root-level operations provides full algorithm diversity.
NIST Guidance
FIPS 205 specifies SLH-DSA in 12 parameter sets, varying hash function, security level, and a size/speed tradeoff.
Hash function options
SHA-2 and SHAKE (SHA-3) variants are both specified. SHA-2 variants are typically faster on hardware without SHA-3 acceleration; SHAKE variants may be preferred in environments with existing SHA-3 infrastructure.
Security levels
128-bit, 192-bit, and 256-bit quantum security options are available. The recommended parameter set depends on the environment's security requirements and signature size tolerance.
Size/speed tradeoff
Each security level offers a 'fast' (f) and 'small' (s) variant. The fast variant produces larger signatures with fewer hash operations; the small variant produces smaller signatures at the cost of more computation.
NIST SP 800-208
Covers stateful hash-based signature schemes (XMSS and LMS) for applications where statefulness is acceptable and signature sizes can be managed. XMSS/LMS are available now and can be used as interim tools where SLH-DSA is not yet implemented.