A signature made only of hashes.
SLH-DSA is FIPS 205. This page runs the fast category-1 set, SHA2-128f. The public key is 32 bytes. The signature is 17,088. There is no ML-DSA half and no Ed25519 half to fall back on, and nothing to take out if someone later finds a shortcut in lattices.
Sign with SHA2-128f
- 01
The key is a hash tree, not a trapdoor.
Forging it means finding a break in SHA-256, not in a lattice problem and not in an elliptic curve.
- 02
It is larger than the hybrid, today.
The hybrid signature is 3,373 bytes. The largest NIST lattice signature, ML-DSA-87, is 4,627. Even the small hash set, SHA2-128s, is 7,856, and it takes seconds to sign. Hash-based signatures win on assumptions now. They win on size only if lattice parameters have to grow a long way. NIST has not published that growth.
- 03
Python does not run this yet.
cryptography 50 ships ML-KEM and ML-DSA. It does not ship SLH-DSA. This library will not vendor a second implementation while that is true.
TODAY
Size, not a slogan
A Bitcoin OP_RETURN still holds 80 bytes. Neither signature goes on chain. The 32-byte commitment does.