SLH-DSA (SPHINCS+, FIPS 205): Algorithm Walkthrough

Every code listing from this chapter of Applied Post-Quantum Cryptography — 3 in total, 3 runnable here. Edit any cell and press Run.

The book's snippets build on each other down the chapter, but a Sage Cell kernel runs one cell and keeps no state afterwards, so each cell replays the earlier listings with apqc_book. That call is the only thing added to the book's own code.

← the playground

Listing 1 — SageMath experiment: addressed Merkle authentication

This small hash-only example checks the part of SLH-DSA verification that folds an authentication path back to a public root. It uses eight leaves and a SHA-256-based toy hash; it is not a FORS, WOTS+, or full SLH-DSA implementation.

Listing 2 — A complete SageMath implementation

The Merkle experiment above is a toy in one respect that matters: it uses a made-up address format. The companion file sage/fips205_slhdsa.sage implements the real thing – all twenty-five numbered algorithms of FIPS 205, each as its own function annotated with its algorithm number, for all twelve approved parameter sets. That means both hash families (SHA2 and SHAKE) at all three security levels in both the s and f variants, together with the WOTS+ chains, the XMSS trees, the hypertree, FORS, the pure and pre-hash top-level algorithms, and the 32-byte address structure with its 22-byte compressed form.

the f parameter sets end to end, and the s sets — whose signing takes minutes — verified against NIST's ACVP signatures

The address is a small class carrying the member functions of Table 1 of the standard, so the recursive tree walk of Algorithm 9 reads exactly as specified:

Listing 3 — A complete SageMath implementation

The hypertree is then just that tree, stacked d deep, with each layer signing the root of the layer below: