SLH-DSA (SPHINCS+)

Type

Digital signature

Family

Hash-based (stateless)

Standard

FIPS 205

Standardized by

NIST

Date

2024-08-13

Status

Final

Last reviewed 2026-09-12 by the PQC Audit Index editors.

Parameter sets and sizes (bytes)

NIST security categories: 1 ≈ AES-128, 2 ≈ SHA-256 collision, 3 ≈ AES-192, 5 ≈ AES-256.

Where SLH-DSA is deployed

• X.509 certificates: RFC 9909 (2025-12)
• Firmware and code signing where long-lived trust and minimal assumptions matter
• OpenSSL 3.5 (2025-04) ships SLH-DSA

What an audit of SLH-DSA checks

• Fault-injection resistance: a single fault during WOTS+ or FORS signing can leak enough to forge; check for redundant computation or verification-after-signing
• Correct ADRS (address) construction and domain separation across the hypertree, FORS, and WOTS+ layers
• Pre-hash (HashSLH-DSA) and context-string handling must match FIPS 205
• Randomizer generation (opt_rand) and hedged signing
• Denial-of-service surface: signature verification cost and signature size (up to 49,856 bytes) in protocols
• Known-answer tests against FIPS 205 final vectors

See the full post-quantum cryptography audit checklist.

Who audits SLH-DSA implementations

Firms with a cryptography practice that review SLH-DSA implementations and protocol integrations, in the order this index lists them:

1. zkSecurity — Cryptography audits: post-quantum, zero-knowledge proofs, MPC, FHE, TEEs
2. Trail of Bits — Software assurance with a dedicated cryptography practice
3. NCC Group (Cryptography Services) — Large security consultancy with a specialist Cryptography Services team
4. Cryspen — Formally verified cryptography and high-assurance post-quantum implementations
5. Kudelski Security — Cryptography audits and quantum-readiness assessments
6. Quarkslab — Reverse engineering, cryptography, and secure implementation research
7. Least Authority — Security audits of cryptographic protocols and privacy-preserving systems
8. Galois — Formal verification of cryptographic code
9. atsec information security — FIPS 140-3 and CAVP validation laboratory
10. Riscure (Keysight) — Side-channel and fault-injection evaluation of hardware implementations
11. Cure53 — Penetration testing and code audits of open-source and web software
12. X41 D-Sec — Source-code audits of open-source security and cryptographic software

Primary sources

• FIPS 205, Stateless Hash-Based Digital Signature Standard
• RFC 9909, SLH-DSA in X.509 (2025-12)

Machine-readable: data.json · summary.txt