07 — Size vs. Speed

The Fundamental Trade-Off

SLH-DSA offers two variants per security level:

This trade-off exists because the "small" variant uses larger FORS and hypertree parameters (more hash computations per signature, but fewer components to include). The "fast" variant uses smaller parameters (fewer hash computations, but more components in the signature).

Concrete Numbers

Level 1 (AES-128 equivalent)

Level 3 (AES-192 equivalent)

Level 5 (AES-256 equivalent)

Why s Is Slower

The "small" variant uses:

• Taller FORS trees (a): Must compute longer Merkle paths (more hash operations)
• Fewer FORS trees (k): Each tree is larger, so path computation is more expensive
• Fewer hypertree layers (d): Each layer is larger, requiring more WOTS+ chains

But the signature is smaller because:

• Fewer FORS trees → fewer Merkle paths to include
• Fewer hypertree layers → fewer WOTS+ signatures to include

Why f Is Faster

The "fast" variant uses:

• Shorter FORS trees (a): Merkle paths are shorter (fewer hash operations)
• More FORS trees (k): Each tree is smaller, but there are more of them
• More hypertree layers (d): Each layer is smaller and faster to traverse

But the signature is larger because:

• More FORS trees → more Merkle paths to include
• More hypertree layers → more WOTS+ signatures and paths to include

Protocol Impact

Benchmarks on Real Hardware

Note: SLH-DSA signing is cache-friendly — the same hash operations repeated many times. Verification is faster because it involves fewer hash computations.

Choosing Between s and f

Comparison with Other PQC Signatures

Resources

• NIST FIPS 205, Section 8: Parameter Sets
• pqm4 benchmarks: github.com/mupq/pqm4 — Embedded benchmarks
• SUPERCOP: bench.cr.yp.to — Standardised benchmarking