Hash-Based Signatures and SPHINCS+: Conservative Post-Quantum Security

Among NIST's post-quantum standards, SLH-DSA (SPHINCS+) occupies a special place: it is the conservative choice, relying only on the security of hash functions rather than newer mathematical assumptions.

The Philosophy of Hash-Based Signatures

Hash functions are among the best-studied primitives in cryptography. SHA-2 and SHA-3 have survived decades of analysis. Hash-based signature schemes build digital signatures entirely from hash functions, so their security reduces to a property we already trust.

If you are signing something that must remain valid for decades — a root certificate, a firmware image, a legal document — a conservative scheme that depends only on hash security is attractive.

Stateful vs Stateless

Hash-based signatures come in two flavours:

• Stateful (e.g. LMS / XMSS, RFC 8554 and NIST SP 800-208): extremely fast and small, but the signer must track state to avoid reusing one-time keys. Reusing state catastrophically breaks security.
• Stateless (SPHINCS+ / SLH-DSA): no state to manage, far easier to deploy safely, but larger signatures and slower signing.

NIST standardised the stateless variant (FIPS 205) as the general-purpose option, and the stateful variants for specific use cases where the signer can guarantee careful state handling.

Trade-offs

• Pros: minimal trust assumptions, well-understood security, no lattice risk.
• Cons: signatures are tens of kilobytes, signing is slower than ML-DSA.

These trade-offs make SLH-DSA ideal for low-frequency, high-value signatures rather than per-connection TLS authentication.

Where to Use It

• Firmware and software update signing.
• Root-of-trust and certificate authority long-term keys.
• Long-term document and timestamp signing.
• As a fallback alongside ML-DSA in a hybrid scheme.

Practical Advice

Use SLH-DSA where the cost of a large signature is acceptable and where you want the strongest assurance that no surprise will emerge from new lattice cryptanalysis. For high-throughput signing, prefer ML-DSA — but keep SLH-DSA as a conservative backup in your crypto-agility toolkit.

Hash-based signatures are the safety net of the post-quantum world: not the fastest, but the most trustworthy.