SLH-DSA (SPHINCS+)

The most conservative post-quantum signature standard — NIST FIPS 205

Technical Explanation

SLH-DSA uses a hybrid construction combining Merkle trees, WOTS+ one-time signatures, and FORS few-time signatures. This stateless design eliminates the state management burden of earlier hash-based schemes, enabling unlimited signatures from a single key pair without tracking which keys have been used.

SLH-DSA Parameter Sets

The algorithm offers multiple parameter sets balancing signature size, security level, and signing speed:

Why SLH-DSA Offers Conservative Security

Unlike lattice-based signatures (ML-DSA/Dilithium), SLH-DSA's security depends only on hash functions being collision-resistant and second-preimage resistant. These properties have been studied extensively for decades:

• No exotic math — No lattice problems, no structured algebraic assumptions
• Minimal attack surface — Only hash function security matters
• One primitive, one assumption — The underlying one-time signatures reduce directly to hash preimage and collision resistance. This is computational security, not information-theoretic: break the hash and you break the signature, but nothing else is required to hold.
• Quantum resilience — Grover's algorithm provides only √n speedup, easily countered

SynX Relevance

SLH-DSA vs ML-DSA (Dilithium)

Algorithm Structure

SLH-DSA Structure:
├── Hypertree (HT)
│   ├── XMSS Tree Layer d-1
│   │   └── WOTS+ One-Time Signatures
│   ├── XMSS Tree Layer d-2
│   │   └── WOTS+ One-Time Signatures
│   └── ... (d layers total)
│
└── FORS (Few-Time Signature)
    ├── Message hash → indices
    └── Reveal secret values

Related Terms

• SPHINCS+ — Original name before NIST standardization
• ML-DSA (Dilithium) — NIST's lattice-based signature alternative
• FIPS 205 — The official NIST standard document
• Hash-Based Cryptography — The broader category
• WOTS+ — Winternitz One-Time Signature Plus