What is SLH-DSA?
SLH-DSA is a post-quantum digital signature standard whose security rests only on hash functions, the well-studied building blocks used throughout cryptography. NIST published it in August 2024 as FIPS 205. It's the conservative option: if a weakness were ever found in the lattice mathematics behind ML-DSA, SLH-DSA would not be affected. The price is large signatures and slower signing, so it suits places where signatures are made rarely and must stay trustworthy for a long time.
What the name means
SLH stands for stateless hash-based. DSA stands for digital signature algorithm. "Stateless" matters: older hash-based schemes, such as LMS and XMSS, need the signer to keep track of which one-time keys have been used, and reusing one can break security. SLH-DSA avoids that bookkeeping. It was developed from SPHINCS+, which came through NIST's competition.
The trade-off in numbers
| ML-DSA-65 | SLH-DSA (smallest to largest) | |
|---|---|---|
| Public key size | 1,952 bytes | 32 to 64 bytes |
| Signature size | 3,309 bytes | 7,856 to 49,856 bytes |
| Signing speed | Fast | Slow, especially the smaller-signature variants |
| Security rests on | Lattice problems | Hash functions only |
Where it fits
SLH-DSA is a natural candidate for long-lived roots of trust and for signing firmware or software, where a few signatures are made, verified many times, and need to stay trusted for years. It's a poor fit for high-volume signing, or for messages and devices with tight size limits. In April 2026 NIST released a draft, SP 800-230, adding SLH-DSA parameter sets for limited use cases where only a small number of signatures will ever be made.
Having two signature standards built on different mathematics is deliberate. It's one reason crypto-agility matters: if one family weakens, systems should be able to switch.
Common confusions
- "Hash-based means proven safe forever." It means fewer assumptions, which is why it's seen as conservative. It isn't a guarantee.
- "SLH-DSA and LMS are the same thing." No. LMS and XMSS are stateful hash-based signatures, standardised separately; SLH-DSA is stateless.
- "Everyone recommends it." Choices differ. US national security guidance, for example, uses LMS and XMSS for firmware signing rather than SLH-DSA.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- StandardFIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA)NIST, 2024
- StandardDraft SP 800-230: additional SLH-DSA parameter sets for limited use casesNIST, 2026
- StandardFIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA)NIST, 2024
- Government guidanceThe Commercial National Security Algorithm Suite 2.0 and quantum computing FAQUS National Security Agency