What is SLH-DSA?

SLH-DSA is the hash-based signature standard NIST published in 2024 as FIPS 205. It is based on SPHINCS+, and its security rests only on hash functions.

Also called SPHINCS+, FIPS 205 or hash-based signature.

How a hash-based signature works

The simplest hash-based signatures can sign only once, because each signature reveals part of the key. SLH-DSA arranges many of them in a tree of Merkle trees, so one key can sign a very large number of messages without keeping track of which parts it used, which is why it is called stateless.

The trade-off

Its signatures are larger than elliptic-curve ones, from about 8 to 50 kilobytes depending on the parameter set. In return they need no assumption beyond the hash.

Why it matters now

Justin Drake has suggested that load-bearing signers such as oracles and security councils add a hash-based scheme like SPHINCS to their signatures.

In Redacted

In bunker mode, nodes sign their approvals and Spending accounts sign their actions with SLH-DSA.

Bunker mode →

Related terms

Post-quantum cryptographyPost-quantum cryptography is cryptography built to stay secure against quantum computers, which could break the elliptic curves and RSA that most wallets and websites rely on today.Hash functionA hash function turns any input into a short fingerprint of fixed size. The same input always gives the same fingerprint, and nobody can work back from it or find two inputs that share one.ECDSAECDSA is the elliptic-curve signature scheme behind most Bitcoin and Ethereum wallets. It proves you hold a private key without showing it, and its security rests on the math of the secp256k1 curve.Merkle treeA Merkle tree fingerprints a long list with one short value, the root, so that anyone can prove an item is in the list with a handful of hashes instead of the whole list.

Sources: FIPS 205, Stateless Hash-Based Digital Signature Standard, NIST

Updated October 12, 2026. All terms