Evidence signature
Public signals bind to governed proof.
No customer data.
QScout proof sequence. Evidence Handshake. public-to-private proof path. No customer data.
Yes. SLH-DSA (formerly SPHINCS+) is quantum safe. It is the NIST-standardized hash-based post-quantum signature algorithm (FIPS 205, August 2024), offering the most conservative security assumptions.
Key Takeaway: SLH-DSA is considered quantum safe. NIST FIPS 205 (standardized August 2024). CNSA 2.0 approved.
SLH-DSA IS quantum safe with the most conservative security assumptions.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), formerly SPHINCS+, is a post-quantum signature scheme standardized by NIST as FIPS 205 in August 2024. It represents the most conservative approach to post-quantum signatures because its security relies entirely on hash function properties (collision resistance, preimage resistance) — the most mature and well-understood area of cryptography.
Unlike lattice-based schemes (ML-DSA) that depend on relatively new mathematical hardness assumptions, SLH-DSA builds on hash-based signature concepts dating back to the 1970s (Lamport signatures, Merkle trees). The algorithm uses a tree structure of one-time signatures (OTS), where each signature uses a unique hash chain. The "stateless" designation means the signer doesn't need to track which OTS instances have been used (unlike earlier stateful hash signatures like XMSS).
SLH-DSA generates signatures by constructing Merkle trees of hash values, signing the message with a one-time signature from a leaf node, and providing an authentication path up the tree to the root (which is the public key). Verification recomputes the hash path and confirms it matches the public key root.
The algorithm has multiple parameter sets targeting different security levels and use cases: SLH-DSA-128s (128-bit security, ~7.8 KB signatures, faster signing), SLH-DSA-128f (128-bit security, ~17 KB signatures, faster verification), SLH-DSA-256s (256-bit security, ~29 KB signatures), and SLH-DSA-256f (256-bit security, ~49 KB signatures).
SLH-DSA has no known quantum vulnerability beyond the generic Grover speedup that affects all hash functions. Its security reduces entirely to the security of the underlying hash function (SHA-256, SHAKE256):
If the hash function is quantum-safe (which SHA-256 is under Grover's algorithm), then SLH-DSA is quantum-safe. There is no algebraic structure (like factoring, discrete logarithms, or even lattices) for quantum algorithms to exploit. This makes SLH-DSA the most conservative post-quantum signature scheme — its security rests on hash functions that have been studied for decades.
For SLH-DSA-256f (highest security variant), breaking the scheme requires breaking SHA-256 or SHAKE256, which provide 128-bit post-quantum collision resistance (far beyond foreseeable quantum capabilities). The conservative nature makes SLH-DSA ideal for ultra-long-lived signatures (root CA certificates valid 2024-2054) where security confidence must span 30+ years.
SLH-DSA is the migration target for long-lived, high-assurance signatures where conservative security outweighs performance concerns:
Root CA Certificates: SLH-DSA is ideal for root certificates with 20-30 year lifetimes. The large signature size (29-49 KB) is acceptable because root certificates are rarely transmitted (stored locally in trust stores). Conservative hash-based security ensures validity through 2040-2060.
Code Signing for Critical Infrastructure: Firmware for nuclear power plants, medical devices, aircraft avionics, and automotive ECUs requires ultra-conservative signatures. SLH-DSA provides maximum confidence in long-term signature validity.
Long-Term Document Signing: Legal contracts, land registries, digital wills, and archival documents requiring multi-decade signature validity benefit from SLH-DSA's conservative security assumptions.
Firmware Signing: Boot ROM signatures, secure boot chains, and hardware root-of-trust implementations should use SLH-DSA for maximum assurance. The signature is verified once per boot, so verification time (slower than ML-DSA) is acceptable.
No industries are at risk from SLH-DSA — it provides ultra-conservative quantum-safe signatures. Industries should adopt SLH-DSA for:
Certificate Authorities: Root and intermediate CA certificates should transition to SLH-DSA for maximum long-term security confidence. The CA/Browser Forum is evaluating SLH-DSA for 20-30 year root certificates.
Medical device manufacturers: FDA-regulated devices with 10-20 year lifetimes should use SLH-DSA for firmware signatures to ensure security through device operational lifetime.
Automotive and aerospace: Safety-critical systems (airbags, flight controls, autonomous driving) require conservative cryptography. SLH-DSA provides hash-based security for firmware signing and secure boot.
Government archival systems: National archives, land registries, and legal document repositories with 50-100 year retention requirements should use SLH-DSA for maximum signature longevity.
SLH-DSA offers the most conservative post-quantum security available. Organizations should deploy SLH-DSA for long-lived certificates (root CAs, code signing) and critical infrastructure where security confidence must span decades. For general-purpose signatures, ML-DSA provides better performance with strong quantum resistance.
| Full Name | Stateless Hash-Based Digital Signature Algorithm (FIPS 205) |
| Category | pqc |
| Key Size | Multiple parameter sets: 128-bit, 192-bit, 256-bit security levels |
| Quantum Vulnerability | No known quantum vulnerability. Security relies only on hash function properties — the most conservative assumption in cryptography. |
| NIST Status | NIST FIPS 205 (standardized August 2024). CNSA 2.0 approved. |
| Deprecation Timeline | Current standard. No deprecation planned. |
| Replaced By | N/A — this IS the post-quantum standard |
Use SLH-DSA for long-lived trust anchors (root CA certificates, firmware signing, code signing) where signature size is acceptable and conservative security is paramount.
SLH-DSA is quantum safe, but your cryptographic posture is only as strong as its weakest link. QScout maps your entire cryptographic inventory in 7 days.