Research

Watch · narrated whiteboard episodesL3

SLH-DSA in Depth: The Security Margins, the Attacks and the Parameter Trade

FIPS 205 is often summarised as the signature that rests on hashing alone. This paper series reads what that sentence leaves out: why every hash call is tweaked with an address and a public seed and what the repaired security proof actually assumes, how security slides as one key signs past its two-to-the-sixty-four budget, why the SHA-2 instantiation needed SHA-512 at the higher categories, how a single induced fault can graft a forged tree onto a genuine key, and how to choose and budget a hash-based root in 2026 now that NIST has drafted limited-use parameter sets and CNSA 2.0 has picked stateful schemes. Every topic is tied to the keys AI agents depend on: model-release roots, tool and plug-in signing, and long-lived firmware anchors.

Murali Chillakuru·5 episodes
  1. 25 min Episode 1Tweakable Hashes and Multi-Target Attacks: What SLH-DSA's Addresses, Public Seed and Proof Actually BuyWhy every SLH-DSA hash call carries a public seed and an address, what the repaired security proof assumes, and what that means for keys that sign models and agent tools.
  2. 20 min Episode 2The Signature Budget: How FORS Turns Two-to-the-Sixty-Four into a Graceful Slope, and What s and f Really TradeWhat sets SLH-DSA's two-to-the-sixty-four budget, how security slides past it, what the small and fast sets really trade, and the one property no budget buys.
  3. 20 min Episode 3SHA-2 versus SHAKE in SLH-DSA: The Category-Five Break, the SHA-512 Patch and the Single-Block TrickWhy FIPS 205's SHA-2 sets widen four functions to SHA-512 at the higher categories, why F and PRF stay on SHA-256, and how to choose a hash family for keys that sign models and agent tools.
  4. 19 min Episode 4Fault Attacks on SLH-DSA: Tree Grafting, Why Verify-After-Sign Misses It, and the Countermeasures That HoldHow one computation fault can graft a forged subtree onto a genuine SLH-DSA key, why verification and randomised signing miss it, and the redundancy and audit controls that hold.
  5. 20 min Episode 5Choosing a Hash-Based Root in 2026: Full SLH-DSA, the Limited-Use Sets, or LMS and XMSSHow to choose a hash-based root key for models, tools and firmware in 2026, why the new limited-use SLH-DSA sets fail gracefully where stateful schemes fail hard, and how to prove a budget holds.