SLH-DSA / SPHINCS+ (FIPS 205)

SLH-DSA - the Stateless Hash-Based Digital Signature Algorithm - is the post-quantum signature standard NIST finalized as FIPS 205 in August 2024. It's based on SPHINCS+, the hash-based scheme that emerged from the same NIST competition that produced ML-DSA. NIST positions SLH-DSA as the backup to ML-DSA, for the case where lattice-based schemes turn out to be vulnerable. In Bitcoin's post-quantum discussion the hash-based family has drawn most of the work, because its security rests only on the hash function holding and it is simpler to implement.

What it is

SLH-DSA constructs signatures from hash function compositions - Merkle trees of one-time signatures, recursively. The security assumption is the hardness of finding hash preimages, plus a few related properties of the same hash functions, which Grover's algorithm weakens but doesn't break.

Three security levels are standardized, each with "small" and "fast" variants (trading signature size for signing speed):

• SLH-DSA-128s: ~7,856-byte signatures, ~128-bit security, slow signing
• SLH-DSA-128f: ~17,088-byte signatures, ~128-bit security, fast signing
• SLH-DSA-192s / 192f: ~16,224 and ~35,664-byte signatures, ~192-bit security
• SLH-DSA-256s: ~29,792-byte signatures, ~256-bit security
• SLH-DSA-256f: ~49,856-byte signatures, ~256-bit security

Public keys are small (~32-64 bytes); signature size is where the cost lives.

Hash-based vs lattice-based

SLH-DSA's security model is fundamentally different from ML-DSA's:

• ML-DSA: security from the assumed hardness of lattice problems. Mathematically well-studied, but cryptographically younger than hash functions.
• SLH-DSA: security from the assumed hardness of inverting hash functions (one-way functions). Hash functions are among the oldest, most-studied, and most-trusted cryptographic primitives.

The trade: hash-based schemes are conservative - built on cryptographic primitives with decades of analysis. But they pay a massive cost in signature size. Lattice-based schemes are more efficient but rely on a younger area of cryptanalysis where future breakthroughs are more plausible.

If you want signatures that won't be broken by any algorithm we don't yet know exists, SLH-DSA is the conservative choice. If you want practical efficiency, ML-DSA wins.

Trade-offs

Compared to Bitcoin's current schemes:

• ECDSA signature: ~71-72 bytes
• Schnorr signature: 64 bytes
• SLH-DSA-128s signature: ~7,856 bytes - over 100x larger
• SLH-DSA-256f signature: ~49,856 bytes - nearly 800x larger

At Bitcoin's scale, full SLH-DSA migration would balloon transaction sizes and compress effective block capacity significantly. The largest parameter sets are arguably impractical for general Bitcoin transactions; the smallest are still about three times larger than ML-DSA's smallest (2,420 bytes for ML-DSA-44).

The case for SLH-DSA in Bitcoin is therefore conservative-cryptography, not efficiency. It would be the choice if the community wanted maximum confidence that no future cryptanalytic breakthrough could threaten the network - at the cost of block-space economics.

Position in the Bitcoin migration discussion

SLH-DSA is the second NIST-standardized PQ signature scheme and the canonical hash-based alternative to ML-DSA. In Bitcoin's discourse, it's usually mentioned as:

• A fallback if lattice schemes are later compromised by a classical attack
• An option for high-value or long-lifetime transactions where conservative security matters more than fees
• A possible component in a hybrid scheme - multiple signatures from different security assumptions on the same transaction

BIP-361's "TBD Post Quantum Signature BIP" hasn't published yet, so the formal Bitcoin position on SLH-DSA is undetermined. The working assumption runs the other way from NIST's ordering: most Bitcoin post-quantum work has gone into hash-based schemes, and the SHRINCS draft BIP (first draft posted August 26, 2026) gets a semi-stateful hash-based signature down to 548 bytes, with a 5,777-byte stateless fallback, by keeping a little state in the wallet.

See the Quantum and Bitcoin rabbit hole for the block-space trade-offs between the candidate schemes.

Spec: FIPS 205 (NIST CSRC).