SLH-DSA
Symmetric · Hash-based · sphincs.org(opens in a new tab)
- Programmes
- FIPS 205
- Latest version
- FIPS 205 ·
- Security flags
- None on current sets
Parameter sets
FIPS 205 · 13 Aug 2024
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| SHAKE-192s Recommended | 3 | 48 | 16,224 | 16,272 | 1.02 s | 842.4 µs |
| SHAKE-256s Recommended | 5 | 64 | 29,792 | 29,856 | 922.57 ms | 1.25 ms |
| SHAKE-128s Recommended | 1 | 32 | 7,856 | 7,888 | 576.41 ms | 575.6 µs |
| SHAKE-256f Recommended | 5 | 64 | 49,856 | 49,920 | 94.58 ms | 2.49 ms |
| SHAKE-192f Recommended | 3 | 48 | 35,664 | 35,712 | 43.56 ms | 2.32 ms |
| SHAKE-128f Recommended | 1 | 32 | 17,088 | 17,120 | 26.55 ms | 1.58 ms |
| SHAKE-128-24 | 1 | 32 | 3,856 | 3,888 | 383.64 s | 83.1 µs |
| SHAKE-192-24 | 3 | 48 | 7,752 | 7,800 | 552.27 s | 157.0 µs |
| SHAKE-256-24 | 5 | 64 | 14,944 | 15,008 | 695.03 s | 175.5 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Only one version of SLH-DSA is recorded, so there is nothing to compare yet.
History
- added to site Update
Added alternative and additional parameter sets for which official code exists; the main sets are marked, so the Recommended filter hides the new ones. SLH-DSA: the three SHAKE sets of the NIST SP 800-230 initial public draft (13 April 2026), SHAKE-128-24, SHAKE-192-24 and SHAKE-256-24, limited to 224 signatures per key, with 3,856, 7,752 and 14,944-byte signatures (Table 1). The draft is not final. We build them from the experimental SP 800-230 support in slhdsa-c PR #51 (not yet merged). The code of the FIPS 205 sets in our benchmark moved to that commit too; compared with before it adds a signature-length check in verification and larger stack buffers, and the algorithms are unchanged. Without a cached hypertree, key generation and each signature rebuild a 221–222-leaf tree and take minutes. SDitH: the six v3.0 instances with cipher-based grinding (specification Table 5, *-cipherpow), from the v3.0.0 code we already benchmark; the L1 and L3 fast instances have 4,643 and 10,452-byte signatures, the others match the main instances. SMAUG-T: TiMER, the additional level-1 parameter set of the v4.0 specification (672-byte public key, 608-byte ciphertext), from its AVX2 implementation in the SMAUG-T code we already benchmark. Timings for the new sets follow from our next benchmark run. Mirath-v, Mirath KeyGen2 and RYDE-v are not added because their code has not been published.
- New version
FIPS 205