papers/hanzo-pq-crypto/sections/05-slh-dsa-for-root-certificates.tex

\section{SLH-DSA for Root Certificates}

\label{sec:slhdsa}
% ============================================================================

SLH-DSA (FIPS 205) provides a conservative backup for long-lived root
certificates. Unlike ML-DSA (lattice-based), SLH-DSA security relies only on
hash function collision resistance---an assumption with decades of confidence.

\begin{definition}[SLH-DSA Security Basis]
SLH-DSA is secure if the underlying hash function (SHA-256 or SHAKE-256) is
second-preimage resistant, a property believed to hold even against quantum
adversaries (Grover reduces security by at most a quadratic factor).
\end{definition}

We use SLH-DSA-SHA2-192s (NIST Level 3, ``small'' variant) for root
certificates:

\begin{table}[H]
\centering
\small
\begin{tabular}{lrr}
\toprule
\textbf{Parameter} & \textbf{SLH-DSA-192s} & \textbf{ML-DSA-65} \\
\midrule
Public key (bytes) & 48 & 1,952 \\
Signature (bytes) & 16,224 & 3,309 \\
Sign (ms) & 180 & 0.12 \\
Verify (ms) & 4.2 & 0.045 \\
\bottomrule
\end{tabular}
\caption{SLH-DSA-192s vs ML-DSA-65. SLH-DSA has smaller keys but much larger
signatures and slower operations.}
\label{tab:slhdsa}
\end{table}

Root certificates are verified rarely (once per TLS session establishment, then
cached), so the 4.2ms verification overhead is acceptable.

% ============================================================================