SLH-DSA (SPHINCS+): standard, dates, parameters, and audit checklist
====================================================================

SLH-DSA is the NIST-standardized stateless hash-based signature scheme, published as FIPS 205 on 2024-08-13. It is derived from SPHINCS+ and relies only on the security of hash functions, making it the conservative backup to lattice signatures.

Standard: FIPS 205
Standardized by: NIST
Date: 2024-08-13
Status: Final
Family: Hash-based (stateless)
Parameter sets: SLH-DSA-SHA2/SHAKE-128s (cat 1, pk 32 B, signature 7856 B); SLH-DSA-SHA2/SHAKE-128f (cat 1, pk 32 B, signature 17088 B); SLH-DSA-SHA2/SHAKE-192s (cat 3, pk 48 B, signature 16224 B); SLH-DSA-SHA2/SHAKE-192f (cat 3, pk 48 B, signature 35664 B); SLH-DSA-SHA2/SHAKE-256s (cat 5, pk 64 B, signature 29792 B); SLH-DSA-SHA2/SHAKE-256f (cat 5, pk 64 B, signature 49856 B)
Audit focus: Fault-injection resistance: a single fault during WOTS+ or FORS signing can leak enough to forge; check for redundant computation or verification-after-signing | Correct ADRS (address) construction and domain separation across the hypertree, FORS, and WOTS+ layers | Pre-hash (HashSLH-DSA) and context-string handling must match FIPS 205 | Randomizer generation (opt_rand) and hedged signing | Denial-of-service surface: signature verification cost and signature size (up to 49,856 bytes) in protocols | Known-answer tests against FIPS 205 final vectors
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://csrc.nist.gov/pubs/fips/205/final | https://datatracker.ietf.org/doc/rfc9909/

Source page: https://pqaudit.org/algorithms/slh-dsa/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12