SLH-DSA
FIPS 205Formerly known as SPHINCS+
A stateless hash-based signature scheme treated as the conservative option: several authorities exempt it from their otherwise-universal hybrid requirement because its security rests only on hash-function security.
Approved or recommended by
12 parameter sets, SHA2 and SHAKE, 128/192/256, s and f variants
Not part of CNSA 2.0 — excluded from National Security Systems use.
FIPS 205, Stateless Hash-Based Digital Signature Standard →Hybridation optional for SPHINCS+/SLH-DSA, unlike lattice-based schemes.
“Hybridation for SPHINCS+ may also be optional.”ANSSI views on the Post-Quantum Cryptography transition (2023 follow-up) →
192s/f · 256s/f, SHA2 and SHAKE
Cat 3 and 5 only; hedged. Hash-based signatures may be used alone, not hybrid.
BSI TR-02102-1, Version 2026-01 →SLH-DSA-256 recommended
Not required to be deployed hybrid, unlike ML-DSA.
“It is not deemed necessary to deploy this scheme in a hybrid combination with elliptic curve primitives.”The PQC Migration Handbook, 2nd edition (Dec 2024) →
Hybridisation not considered necessary for hash-based signatures.
CCN-TEC 009 BP/37 (July 2026) →Named by NIST citation defining the guidance's scope; Switzerland publishes no independent algorithm list of its own.
FINMA Guidance 05/2026 (9 July 2026) →This page lists only jurisdictions we have researched and where a primary source names a position on SLH-DSA specifically. Absence from this list is not evidence a country prohibits or ignores it -- see that country's page directly.