Research seriesL3algorithms
FIPS 205 is often summarised as the signature that rests on hashing alone. This paper series reads what that sentence leaves out: why every hash call is tweaked with an address and a public seed and what the repaired security proof actually assumes, how security slides as one key signs past its two-to-the-sixty-four budget, why the SHA-2 instantiation needed SHA-512 at the higher categories, how a single induced fault can graft a forged tree onto a genuine key, and how to choose and budget a hash-based root in 2026 now that NIST has drafted limited-use parameter sets and CNSA 2.0 has picked stateful schemes. Every topic is tied to the keys AI agents depend on: model-release roots, tool and plug-in signing, and long-lived firmware anchors.
Every hash call inside SLH-DSA carries a public seed and a 32-byte address. That detail is what stops one key's own size from becoming its weakness.
SLH-DSA promises full security for 2 to the power 64 signatures per key. What happens after that is a slope, not a cliff, and the s and f sets walk it differently.
FIPS 205 quietly swaps SHA-256 for SHA-512 in four of six functions at its higher categories. The reason is a 256-bit internal state, and it explains which functions changed.
One corrupted computation can turn SLH-DSA's harmless key repetition into one-time-key reuse, and the faulty signature still verifies. Here is why, and what closes it.
NIST has drafted SLH-DSA sets capped at 2 to the 24 signatures, and CNSA 2.0 chose stateful schemes. For a long-lived root, the choice now has four branches and one proof obligation.