{"id":1228,"date":"2026-11-10T08:34:11","date_gmt":"2026-11-10T07:34:11","guid":{"rendered":"https:\/\/hadamard.com\/c\/ml-dsa-vs-slh-dsa-signatures-compared\/"},"modified":"2026-11-10T08:34:11","modified_gmt":"2026-11-10T07:34:11","slug":"ml-dsa-vs-slh-dsa-signatures-compared","status":"publish","type":"post","link":"https:\/\/hadamard.com\/c\/ml-dsa-vs-slh-dsa-signatures-compared\/","title":{"rendered":"ML-DSA vs SLH-DSA: Signature Sizes, Speed and Which to Use"},"content":{"rendered":"

ML-DSA (FIPS 204) is NIST’s primary post-quantum signature. It is lattice-based and fast, and its smallest signatures are 2,420 bytes. SLH-DSA (FIPS 205) is the hash-based backup: its public keys are only 32 to 64 bytes, but its signatures run from 7,856 to 49,856 bytes and take far longer to create. That trade-off makes ML-DSA the default for TLS and high-volume signing, while SLH-DSA suits firmware, software releases and long-lived roots, where a conservative security assumption matters more than speed.<\/p>\n

This ML-DSA vs SLH-DSA comparison covers exact sizes for every parameter set, relative speed, why NIST standardized two signatures, and what has changed since the standards were finalized, including the SP 800-230 draft published in April 2026.<\/p>\n

ML-DSA vs SLH-DSA at a glance: two standards, two kinds of math<\/h2>\n

NIST published FIPS 204 (ML-DSA)<\/a> and FIPS 205 (SLH-DSA)<\/a> as final standards on August 13, 2024, almost a year after the drafts appeared on August 24, 2023. According to the Federal Register notice<\/a>, “FIPS 203, FIPS 204, and FIPS 205 are effective on August 14, 2024.”<\/p>\n

The two rest on different foundations. In its announcement<\/a>, NIST says ML-DSA is module-lattice-based, derived from CRYSTALS-Dilithium, and serves as the primary signature standard. SLH-DSA is hash-based and derived from SPHINCS+. NIST describes it as “intended as a backup method in case ML-DSA proves vulnerable,” built on a different mathematical approach.<\/p>\n

The FIPS 205 abstract describes SLH-DSA as a stateless hash-based digital signature algorithm whose signatures detect unauthorized changes, authenticate the signer and provide non-repudiation. ML-DSA offers the same properties. What differs is the assumption underneath: lattice problems for ML-DSA, and only the security of the hash function for SLH-DSA.<\/p>\n

ML-DSA vs SLH-DSA signature size, byte for byte<\/h2>\n

Size is usually the first constraint engineers hit. The ML-DSA figures below come from RFC 9881<\/a>, the IETF Proposed Standard for ML-DSA in X.509 certificates and CRLs. They are raw sizes, without ASN.1 overhead.<\/p>\n\n\n\n\n\n\n\n
ML-DSA set<\/th>\nSignature<\/th>\nPublic key<\/th>\nPrivate key (seed)<\/th>\nPrivate key (expanded)<\/th>\n<\/tr>\n<\/thead>\n
ML-DSA-44<\/td>\n2,420 B<\/td>\n1,312 B<\/td>\n32 B<\/td>\n2,560 B<\/td>\n<\/tr>\n
ML-DSA-65<\/td>\n3,309 B<\/td>\n1,952 B<\/td>\n32 B<\/td>\n4,032 B<\/td>\n<\/tr>\n
ML-DSA-87<\/td>\n4,627 B<\/td>\n2,592 B<\/td>\n32 B<\/td>\n4,896 B<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SLH-DSA has twelve parameter sets: six sizes, each available with SHA2 or SHAKE. RFC 9909<\/a> lists the sizes, which are the same for both hash families and for both Pure and HashSLH-DSA.<\/p>\n\n\n\n\n\n\n\n\n\n\n
SLH-DSA set<\/th>\nNIST level<\/th>\nSignature<\/th>\nPublic key<\/th>\nPrivate key<\/th>\n<\/tr>\n<\/thead>\n
128s<\/td>\n1<\/td>\n7,856 B<\/td>\n32 B<\/td>\n64 B<\/td>\n<\/tr>\n
128f<\/td>\n1<\/td>\n17,088 B<\/td>\n32 B<\/td>\n64 B<\/td>\n<\/tr>\n
192s<\/td>\n3<\/td>\n16,224 B<\/td>\n48 B<\/td>\n96 B<\/td>\n<\/tr>\n
192f<\/td>\n3<\/td>\n35,664 B<\/td>\n48 B<\/td>\n96 B<\/td>\n<\/tr>\n
256s<\/td>\n5<\/td>\n29,792 B<\/td>\n64 B<\/td>\n128 B<\/td>\n<\/tr>\n
256f<\/td>\n5<\/td>\n49,856 B<\/td>\n64 B<\/td>\n128 B<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How they compare with Ed25519 and RSA-2048<\/h3>\n

Cloudflare’s comparison<\/a> by Bas Westerbaan and Luke Valenta gives the classical baseline. Ed25519 has a 32-byte public key and a 64-byte signature, and RSA-2048 uses 256 bytes for each. An ML-DSA-44 signature is therefore about 38 times larger than an Ed25519 signature. An SLH-DSA-128s signature is more than 120 times larger.<\/p>\n

The two schemes fail on size in different ways. ML-DSA’s public keys and signatures are both large; as Cloudflare puts it, “The big downside is that its signatures and public keys are large.” SLH-DSA’s public key is as small as Ed25519’s, but almost all of its cost sits in the signature.<\/p>\n

How fast are ML-DSA and SLH-DSA?<\/h2>\n

Cloudflare normalized CPU time to ML-DSA-44 = 1. These are rough ratios, and the post warns that “CPU performance varies significantly by platform and implementation.”<\/p>\n