SLH-DSA

What it is and what it does

SLH-DSA is a pure Python cryptographic library that implements the Stateless Hash-Based Digital Signature Algorithm as defined in FIPS 205. It provides a straightforward API for generating keypairs, signing messages, and verifying signatures, with support for both deterministic and randomized signing modes. The package has zero external dependencies, full type hints, and supports Python 3.9 through 3.14.

The library is designed for developers who need post-quantum-resistant digital signatures or want to experiment with hash-based cryptography. It offers both high-level convenience methods (like `sign_pure` and `verify_pure`) and low-level APIs for advanced use cases. Keypairs and secret keys can be exported and imported using standard PKCS formats, making it practical for integration into larger systems.

Use it for:

• Implementing post-quantum-resistant digital signatures in applications where FIPS 205 compliance is required or desired.
• Signing and verifying messages in cryptographic protocols that need stateless, hash-based signatures.
• Exporting and restoring cryptographic keys in PKCS format for cross-system key management.
• Experimenting with SPHINCS+-derived signature schemes in research or proof-of-concept projects.
• Building cryptographic systems where deterministic or randomized signing modes must be selectable.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Pure Python implementation of the SLH-DSA stateless hash-based digital signature algorithm specified in FIPS 205, with no external dependencies.

Yes, if you need FIPS 205 digital signatures and want a dependency-free pure Python implementation. The package is actively maintained, well-typed, and supports current Python versions. However, verify whether the implementation has undergone formal security audit and whether performance meets your requirements before using in production systems with high-assurance security needs.

Install

slh-dsa on PyPI

pip install slh-dsa

uv add slh-dsa

poetry add slh-dsa

Installing SLH-DSA

Before you install

Low friction: pure Python wheel with zero runtime dependencies. Actively maintained with recent release (14 days old) and current Python version support (3.9–3.14). Repository shows recent activity and is not archived.

License in practice

Licensed under LGPL-3.0-or-later (copyleft). You may use and modify the package freely, but any derivative work must also be licensed under LGPL-3.0-or-later and source code must be made available to recipients.

Quickstart

pip install slh-dsa

from slhdsa import KeyPair, shake_256f

kp = KeyPair.gen(shake_256f)
sig = kp.sign_pure(b"Hello World!", randomize=False)
kp.verify_pure(b"Hello World!", sig)  # -> True

Requires Python 3.9 or later.

Verify before relying

• Whether the implementation has undergone formal security audit or FIPS 205 certification beyond the specification alignment claimed.
• Performance characteristics (signature size, key generation time, verification speed) relative to other FIPS 205 implementations.
• Whether randomization modes and low-level APIs are suitable for production use or primarily for experimentation.

Package facts

Evidence: slh_dsa-0.2.4-py3-none-any.whl

Keywords: fips205, slhdsa, sphincs, sphincsplus, crypto, cryptography

Tags

More Software Development packages