{
  "slug": "slh-dsa",
  "name": "SLH-DSA",
  "aka": "SPHINCS+",
  "kind": "Digital signature",
  "family": "Hash-based (stateless)",
  "standard": "FIPS 205",
  "standard_url": "https://csrc.nist.gov/pubs/fips/205/final",
  "body": "NIST",
  "date": "2024-08-13",
  "status": "Final",
  "summary": "SLH-DSA is the NIST-standardized stateless hash-based signature scheme, published as FIPS 205 on 2024-08-13. It is derived from SPHINCS+ and relies only on the security of hash functions, making it the conservative backup to lattice signatures.",
  "parameter_sets": [
    {
      "name": "SLH-DSA-SHA2/SHAKE-128s",
      "category": 1,
      "pk": 32,
      "sk": 64,
      "ct_or_sig": 7856
    },
    {
      "name": "SLH-DSA-SHA2/SHAKE-128f",
      "category": 1,
      "pk": 32,
      "sk": 64,
      "ct_or_sig": 17088
    },
    {
      "name": "SLH-DSA-SHA2/SHAKE-192s",
      "category": 3,
      "pk": 48,
      "sk": 96,
      "ct_or_sig": 16224
    },
    {
      "name": "SLH-DSA-SHA2/SHAKE-192f",
      "category": 3,
      "pk": 48,
      "sk": 96,
      "ct_or_sig": 35664
    },
    {
      "name": "SLH-DSA-SHA2/SHAKE-256s",
      "category": 5,
      "pk": 64,
      "sk": 128,
      "ct_or_sig": 29792
    },
    {
      "name": "SLH-DSA-SHA2/SHAKE-256f",
      "category": 5,
      "pk": 64,
      "sk": 128,
      "ct_or_sig": 49856
    }
  ],
  "size_label": "Signature",
  "deployments": [
    "X.509 certificates: RFC 9909 (2025-12)",
    "Firmware and code signing where long-lived trust and minimal assumptions matter",
    "OpenSSL 3.5 (2025-04) ships SLH-DSA"
  ],
  "audit_focus": [
    "Fault-injection resistance: a single fault during WOTS+ or FORS signing can leak enough to forge; check for redundant computation or verification-after-signing",
    "Correct ADRS (address) construction and domain separation across the hypertree, FORS, and WOTS+ layers",
    "Pre-hash (HashSLH-DSA) and context-string handling must match FIPS 205",
    "Randomizer generation (opt_rand) and hedged signing",
    "Denial-of-service surface: signature verification cost and signature size (up to 49,856 bytes) in protocols",
    "Known-answer tests against FIPS 205 final vectors"
  ],
  "references": [
    [
      "FIPS 205, Stateless Hash-Based Digital Signature Standard",
      "https://csrc.nist.gov/pubs/fips/205/final"
    ],
    [
      "RFC 9909, SLH-DSA in X.509 (2025-12)",
      "https://datatracker.ietf.org/doc/rfc9909/"
    ]
  ],
  "url": "https://pqaudit.org/algorithms/slh-dsa/",
  "updated": "2026-09-12"
}