Post-Quantum Signatures: Fiat-Shamir Lattices versus Hash Trees

Before comparing post-quantum signature schemes, pin down what they must achieve: unforgeability against an adversary who can request signatures at will — and the two philosophies that reach it.

ML-DSA turns a lattice identification protocol into a signature, then rejection-samples every response so the transcript reveals nothing about the secret key.

SLH-DSA builds a stateless signature from nothing but a hash function, stacking one-time keys into Merkle trees and Merkle trees into a hypertree — trading large signatures for the most conservative assumption available.

XMSS and LMS give small, fast hash-based signatures by keeping a Merkle tree of one-time keys and a counter of which leaf is next — but reuse a single leaf and the scheme falls.

There is no universal winner among the post-quantum signatures. The right choice falls out of four axes — conservatism, size and speed, statefulness, and key lifetime — applied to your context.