SPHINCS+ (SLH-DSA): NIST Post-Quantum Digital Signature
Hash-based signatures for the quantum era
Introduction
SPHINCS+ — now officially standardized as SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) — is a post-quantum digital signature scheme selected by NIST and published as FIPS 205 in August 2024.
Unlike lattice-based schemes like Dilithium, SPHINCS+ is based entirely on hash functions — one of the most battle-tested primitives in cryptography. Its security relies only on the collision resistance and preimage resistance of hash functions like SHA-2 and SHAKE.
Key advantage: SPHINCS+ has the most conservative security assumptions of any NIST PQC standard — if hash functions remain secure, SPHINCS+ remains secure.
How SPHINCS+ Works
SPHINCS+ is a stateless hash-based signature scheme built from several components:
- WOTS+ (Winternitz One-Time Signature) — signs a single message using hash chains
- XMSS trees — aggregate WOTS+ signatures into a tree structure
- FORS (Forest Of Random Subsets) — a few-time signature scheme used as an inner layer
- Hypertree — a multi-layer XMSS structure that allows stateless operation
Parameter Sets (FIPS 205)
| Variant | Hash | Security | Public Key | Private Key | Signature |
|---|---|---|---|---|---|
| SLH-DSA-SHA2-128f | SHA-256 | 128-bit | 32 B | 64 B | 17,088 B |
| SLH-DSA-SHA2-128s | SHA-256 | 128-bit | 32 B | 64 B | 7,856 B |
| SLH-DSA-SHA2-192f | SHA-512 | 192-bit | 48 B | 96 B | 35,664 B |
| SLH-DSA-SHA2-192s | SHA-512 | 192-bit | 48 B | 96 B | 16,224 B |
| SLH-DSA-SHA2-256f | SHA-512 | 256-bit | 64 B | 128 B | 49,856 B |
| SLH-DSA-SHA2-256s | SHA-512 | 256-bit | 64 B | 128 B | 29,792 B |
| SLH-DSA-SHAKE-128f | SHAKE-128 | 128-bit | 32 B | 64 B | 17,088 B |
| SLH-DSA-SHAKE-256s | SHAKE-256 | 256-bit | 64 B | 128 B | 29,792 B |
SPHINCS+ vs Dilithium
| Property | SPHINCS+ (SLH-DSA) | Dilithium (ML-DSA) |
|---|---|---|
| Security basis | Hash functions only | Module-LWE (lattice) |
| Security conservatism | Very high | High |
| Signature size | Large (8–50 KB) | Small (2.4–4.6 KB) |
| Public key size | Very small (32–64 B) | Medium (1.3–2.6 KB) |
| Signing speed | Slower | Faster |
| Stateless | Yes | Yes |
| NIST standard | FIPS 205 | FIPS 204 |
| Best use case | Code signing, certificates, long-term security | TLS, general purpose |
When to use SPHINCS+
- Maximum security conservatism — when you need minimal assumptions (only hash function security)
- Long-term signatures — documents, code signing, firmware updates that must be verifiable for decades
- Bandwidth is not critical — the large signature size is acceptable for your use case
- Compliance — when FIPS 205 compliance is required
References
- FIPS 205: Stateless Hash-Based Digital Signature Standard (2024) — NIST
- Bernstein et al., "SPHINCS+: Stateless Hash-Based Signatures" (2019)
- sphincs.org — official SPHINCS+ website
- NIST PQC Project