SLH-DSA KeyGen (FIPS 205)

Category: Post-Quantum Cryptography · Node Type ID: pqc-slhdsa-keygen

Stateless Hash-Based Digital Signature Algorithm keypair generator (FIPS 205)

Overview

Generates a post-quantum stateless hash-based digital signature keypair using SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+) as standardized in NIST FIPS 205.

Because SLH-DSA relies exclusively on the cryptographic security of its underlying hash function (SHA-2 or SHAKE) rather than lattice or number-theoretic assumptions, it provides conservative long-term post-quantum security with very compact keys (32B public / 64B secret for 128-bit sets; 64B public / 128B secret for 256-bit sets). Parameter sets ending in s optimize for smaller signatures, while sets ending in f optimize for faster signing.

When to Use

Generating conservative hash-based post-quantum root keys for code signing, root CA certificates, or long-lived archival signatures with SLH-DSA Sign and SLH-DSA Verify.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Parameter Set `variant`	`select` Default: `slh_dsa_sha2_128s`	Always visible	Selects the FIPS 205 parameter set: `slh_dsa_sha2_128s` (32B pub / 64B sec / 7,856B sig), `slh_dsa_sha2_128f` (32B pub / 64B sec / 17,088B sig, fast), `slh_dsa_shake_128s`, `slh_dsa_shake_128f`, `slh_dsa_sha2_256s` (64B pub / 128B sec / 29,792B sig), or `slh_dsa_shake_256s`. `slh_dsa_sha2_128s`: SLH-DSA-SHA2-128s (Small Signature) `slh_dsa_sha2_128f`: SLH-DSA-SHA2-128f (Fast) `slh_dsa_shake_128s`: SLH-DSA-SHAKE-128s `slh_dsa_shake_128f`: SLH-DSA-SHAKE-128f `slh_dsa_sha2_256s`: SLH-DSA-SHA2-256s `slh_dsa_shake_256s`: SLH-DSA-SHAKE-256s

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

This node has no input ports.

Output Ports

Port Nature: Fixed Output Ports (2 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Public Key`	`publicKey`	`Bytes`	Always visible	SLH-DSA verification public key (32 bytes for 128s/128f variants, 64 bytes for 256s variants).
`Secret Key`	`secretKey`	`Bytes`	Always visible	SLH-DSA signing secret key (64 bytes for 128s/128f variants, 128 bytes for 256s variants).

Error Cases

This node has no runtime failure cases (errorProfile: none) and always succeeds for any valid typed input.

Examples

Generating an SLH-DSA-SHA2-128f Keypair

Create a fast stateless hash-based signature keypair.

Set Parameter Set to SLH-DSA-SHA2-128f (Fast) and wire Secret Key and Public Key to SLH-DSA Sign and Verify.