SLH-DSA

The SLH-DSA project is a pure Python implementation of the Stateless Hash-Based Digital Signature Algorithm, as specified in FIPS 205 (derived from the SPHINCS+ algorithm).

Features

This project offers the following features:

1. 🍻 Zero dependencies!
2. 🏷️ 100% type-hinted codebase!
3. ✅ 100% test coverage!
4. 🔖 Supports modern Python versions!
5. ⚒️ Designed for humans!
6. 🎉 More features coming soon!

Notice

Python 3.9 support will be dropped in v1.0.

v0.2.5 is the last release that supports Python 3.9. If you need to continue using Python 3.9, please pin the package to v0.2.5.

Installation

pip install slh-dsa

Quick Start

The functionality is extremely simple to use, as demonstrated by the following example:

from slhdsa import KeyPair, shake_256f, PublicKey, SecretKey

# Generate the keypair
kp = KeyPair.gen(shake_256f)

# Sign the message w/o randomization
sig = kp.sign_pure(b"Hello World!", randomize=False)

# Verify the signature
kp.verify_pure(b"Hello World!", sig)        # -> True
kp.verify_pure(b"Hello World!", b"I'm the hacker!") # -> False
kp.verify_pure(b"hello world!", sig)        # -> False

# Sign the message with randomization
sig = kp.sign_pure(b"Hello World!", randomize=True)
kp.verify_pure(b"Hello World!", sig)        # -> True

# Export the public key digest so other devices can verify the signature
digest = kp.pub.digest()

# Recover the public key from the digest
pub = PublicKey.from_digest(digest, shake_256f)
pub.verify_pure(b"Hello World!", sig)       # -> True
pub.verify_pure(b"Hello World", sig)        # -> False

# Export the secret key in PKCS format
kp.sec.to_pkcs("seckey.pem")

# Restore the secret key from the PKCS file
assert SecretKey.from_pkcs("seckey.pem") == kp.sec  # -> True

# LowLevel APIs
kp.verify(b'11223344', kp.sign(b'11223344'))  # -> True

License & Copyright

Copyright (c) 2024-2025 Colinxu2020. All Rights Reserved.

This software is licensed under the GNU Lesser General Public License Version 3 or later (at your option).