What is a hash-based signature?

A hash-based signature proves that the holder of a private key approved a message, and its security rests only on a hash function. Leslie Lamport described the basic idea in 1979, and SLH-DSA, published as FIPS 205 in 2024, is a modern version.

Also called Lamport signature, Merkle signature scheme or XMSS.

How the basic idea works

The signer makes many secret values and publishes the hash of each one. To sign a message, the signer reveals a chosen subset of those secrets, with the choice set by the message. A verifier hashes each revealed value and compares it with the published list, so a forger would have to invert the hash to fake a signature.

Each signature reveals secrets, so a key pair can safely sign one document. Lamport’s paper says a signer must use a different set of keys for each document.

From one key to many

Merkle trees let one public key stand for many one-time keys. The one-time public keys become the leaves of a tree, the root becomes the public key, and each signature carries its one-time signature plus the authentication path up the tree. SLH-DSA uses this structure in several layers, as a hypertree of XMSS trees.

Stateless and stateful schemes

A stateful scheme must track how many one-time keys it has used, and reusing one of them breaks security. SLH-DSA is stateless: its message digest pseudorandomly selects which key signs, so the signer keeps no count to protect.

The trade-off

The price is size. SLH-DSA public keys are 32 to 64 bytes, while its signatures run from about 8 to 50 kilobytes, depending on the parameter set. In return, its security rests on hash functions alone.

In Redacted

In bunker mode, nodes sign their approvals and Spending accounts sign their actions with SLH-DSA, a hash-based signature. Notes, proofs and signatures all rest on hashes, with no curves and no lattices.

Bunker mode →

Related terms

SLH-DSASLH-DSA is the hash-based signature standard NIST published as FIPS 205 on 13 August 2024. It is based on SPHINCS+, its security rests on hash functions alone, and the signer keeps no state between signatures.FIPS 205FIPS 205 is the NIST standard for SLH-DSA, a digital signature scheme built on hash functions alone, published in August 2024. It sits beside FIPS 203 and FIPS 204 as one of NIST’s first three post-quantum standards.Merkle treeA Merkle tree fingerprints a long list with one short value, the root, so that anyone can prove an item is in the list with a handful of hashes instead of the whole list.Hash functionA hash function turns any input into a short fingerprint of fixed size. The same input always gives the same fingerprint, and nobody can work back from it or find two inputs that share one.Post-quantum cryptographyPost-quantum cryptography is ordinary cryptography designed to stay secure when large quantum computers exist. It replaces the key exchanges and signatures that Shor’s algorithm breaks, such as RSA and elliptic curves, with schemes built on lattices, hash functions or error-correcting codes.ECDSAECDSA is the elliptic-curve signature scheme behind most Bitcoin and Ethereum wallets. It proves that the holder of a private key approved a message without revealing the key, and its security rests on the secp256k1 curve.

Sources: Constructing Digital Signatures from a One Way Function, Leslie Lamport, 1979 · The SPHINCS+ Signature Framework, Bernstein et al., 2019 · FIPS 205, Stateless Hash-Based Digital Signature Standard, NIST, 2024

Updated November 1, 2026. All terms