Algorithm

SLH-DSA

Family: hash-based.

SLH-DSA is the NIST standard form of the SPHINCS+ signature scheme. It builds signatures from a tree of hash computations, so it needs no lattice or number-theory assumptions. It is stateless: the signer does not track which keys it has used. The trade-off is size, since signatures run from about eight to fifty kilobytes and signing is slower than for lattice schemes.

Safety: High

Why this rating

Security rests only on the properties of the hash function, the most conservative assumption available. The scheme is stateless, so there is no one-time-key reuse risk. Signatures are large and signing is slow, which is a cost in size and speed rather than in safety.

Standard

https://csrc.nist.gov/pubs/fips/205/final

Research

• The SPHINCS+ Signature Framework (2019)
• FIPS 205: Stateless Hash-Based Digital Signature Standard

Implemented by

• liboqs