Future inclusion of Additional SLH-DSA Parameter Sets for Limited Signature Use Cases (SP 800-230)

[RodriM11]

Hello! NIST recently published SP 800-230 (IPD) regarding new parameter sets for reduced cryptographic sizes of signatures of up to 2^24 signatures per private key, as opposed to the default target of 2^64 of SLH-DSA.

I am wondering whether this additional set will be included as part of the project. Thanks in advance.

[mkannwischer]

Yes, those should absolutely be included. If I understand correctly, the current implementation already supports the params internally and one would juts have to add them to the external API.

@mjosaarinen, are you planning to add them yourself, or should someone else add them?

[mjosaarinen]

Yes, those should absolutely be included. If I understand correctly, the current implementation already supports the params internally and one would juts have to add them to the external API.

@mjosaarinen, are you planning to add them yourself, or should someone else add them?

If someone wants to do the update, that would be great. But I can see that it actually requires quite some care, especially since NIST didn't immediately release test vectors. I have run experiments with the SP 800-230 IPD parameter sets (and dozens of others), but I was not so careful about serialization/deserialization details with those experiments *

There are some implementation details that one can get easily wrong/different; for example, while all FIPS 205 parameter sets had lg_w=4 (Winternitz chains of length 16 -- serialized as nibbles), the new parameter set SLH-DSA-SHAKE/SHA2-192-24 have lg_w=3, which requires serialization/deserialization of 3-bit fields that don't align with byte boundaries. Such things are easy to get wrong.

Even though it is short, the IPD has some things I don't fully understand or which may just be bugs; for example, on lines 215-217 it says "to improve signing performance, an implementation may optionally cache some specific levels (a part) of the SLH-DSA hypertree or the whole hypertree". All of the parameter sets in SP 800-230 IPD have d=1; there is no hypertree.