SLH-DSA / SPHINCS+

SHA-256 Merkle Tree

A real SHA-256 Merkle tree computed in your browser. Select a leaf to highlight its authentication path.

WOTS+ One-Time Signature Chains

Illustrative demonstration — shows the hash-chain concept underlying WOTS+ (FIPS 205, Section 4). Signing reveals one point per chain, chosen by a message nibble. Not a production implementation.

Generate WOTS+ Key (4 chains, w=16)

WOTS+ signing controls

Message nibble (0-15): Chain index: Sign (reveal chain point) Verify

Catastrophic Reuse → Forgery

Reveal at least one point (sign above), then forge a signature for a higher step without the private seed — by hashing the lowest revealed value forward. The forged value equals what the honest signer would have revealed, so it verifies against the public key.

WOTS+ forgery controls

Chain index: Forge step (0-16): Forge & Verify

FORS — Forest Of Random Subsets (FIPS 205 §8)

In one sentence: FORS hashes your message into k indices, and each index reveals one leaf from its own tree; because it is few-time, reusing the key leaks slowly instead of catastrophically (contrast WOTS+ in step 2).

Parallel pedagogical reconstruction. The parameter values (k trees, a = tree height, t = 2^a leaves) are read from the real @noble/post-quantum PARAMS table — the same library that signs in Tab 1. The trees, digest split, and FORS public key are an independent educational model: noble exposes no FORS internals via its API. The base_2b digest→index slicing is implemented exactly per FIPS 205 Algorithm 4.

Hypertree — d Layers of XMSS

Illustrative structure using the real d, h, h′ from @noble/post-quantum PARAMS. Each XMSS tree is drawn as a schematic triangle (its 2^h′ leaves are too many to draw literally). The highlighted path climbs from a bottom-layer FORS public key to the top root = the SLH-DSA public key.

Collision Tolerance — Why FORS Degrades Gracefully

Sign two different messages with the same key and compare their k FORS index vectors. Trees that select the same leaf reveal the same secret (no new leak). The contrast with WOTS+ (Tab 3) is the whole point: WOTS+ reuse is catastrophic on use #2; FORS reuse degrades gracefully — that graceful degradation IS few-time security, and it is why SLH-DSA can be stateless.

Illustrative security margin

A rough, illustrative estimate (NOT a proof) of the chance a fresh target message is already forgeable after N honest signatures with the same key, assuming each signature reveals one uniformly-random leaf per tree.

Signed Ledger

Append-only ledger of SPHINCS+ signed entries. Each entry uses a fresh keypair — no shared keys or PKI required.

Add a new ledger entry

Author name Ledger message Parameter set 128f 128s 256f 256s Add Entry

Security Basis: Hash-Only Assumption

Signature Scheme Comparison

Signing Speed (this session)