slh_dsa_sign_verify/

slh_dsa_sign_verify.rs

// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 Cédric Mesnil <cslashm@pm.me>

// SLH-DSA Sign / Verify Example
//
// Demonstrates the SLH-DSA stateless hash-based signature scheme (FIPS 205)
// using the SHAKE-128f parameter set (NIST Security Category 1, fast variant).
//
// Unlike lattice-based schemes (ML-KEM, ML-DSA), SLH-DSA relies *only* on the
// security of cryptographic hash functions (SHAKE/SHA-3). It has no algebraic
// structure that could be exploited by future mathematical advances, making it
// the most conservative post-quantum signature choice.
//
// The trade-off is signature size: SLH-DSA-SHAKE-128f produces 17,088-byte
// signatures (compared to ~2,420 for ML-DSA-44). Key sizes are tiny (32/64
// bytes), but signing is slower due to the deep Merkle-tree traversal.
//
// Architecture of an SLH-DSA signature:
//   - A randomizer R (16 bytes for 128f)
//   - A FORS few-time signature (Forest of Random Subsets)
//   - A hypertree signature (d layers of XMSS Merkle trees with WOTS+ leaves)
//
// Run:
//   cargo run --example sign_verify -p slh_dsa

use quantica::slh_dsa::*;
use std::time::Instant;

/// Pretty-print a byte slice as a hex string.
fn hex(bytes: &[u8]) -> String {
    bytes.iter().map(|b| format!("{:02x}", b)).collect()
}

fn main() {
    println!("=== SLH-DSA (FIPS 205) Sign / Verify Example ===\n");

    let mut rng = OsRng;

    // ---------------------------------------------------------------
    // Step 1: Key generation (SHAKE-128f)
    // ---------------------------------------------------------------
    // SHAKE-128f is the fastest 128-bit security parameter set.
    // Keys are very small: sk = 64 bytes, pk = 32 bytes.
    let t0 = Instant::now();
    let (sk, pk) = SlhDsa::<Shake128f>::keygen(&mut rng).expect("keygen failed");
    let keygen_us = t0.elapsed().as_micros();

    println!("--- Key Generation (SLH-DSA-SHAKE-128f) ---");
    println!("  secret key:  {} bytes", sk.len());
    println!("  public key:  {} bytes", pk.len());
    println!("  pk (hex):    {}", hex(&pk));
    println!("  time:        {} us", keygen_us);
    println!();

    // ---------------------------------------------------------------
    // Step 2: Sign a message
    // ---------------------------------------------------------------
    // SLH-DSA signing traverses a hypertree of Merkle trees, which is
    // computationally intensive. The "f" (fast) variants are optimized
    // for speed at the cost of larger signatures.
    let message = b"Hash-based signatures: conservative post-quantum security.";

    let t0 = Instant::now();
    let sig = SlhDsa::<Shake128f>::sign(message, b"", &sk, &mut rng).expect("sign failed");
    let sign_ms = t0.elapsed().as_millis();

    println!("--- Signing ---");
    println!("  message:     {:?}", std::str::from_utf8(message).unwrap());
    println!("  signature:   {} bytes", sig.len());
    println!("  sig[0..32]:  {}", hex(&sig[..32]));
    println!("  time:        {} ms", sign_ms);
    println!();

    // ---------------------------------------------------------------
    // Step 3: Verify the signature
    // ---------------------------------------------------------------
    let t0 = Instant::now();
    let valid = SlhDsa::<Shake128f>::verify(message, b"", &sig, &pk).expect("verify call failed");
    let verify_ms = t0.elapsed().as_millis();

    println!("--- Verification ---");
    println!("  valid:       {}", valid);
    println!("  time:        {} ms", verify_ms);
    assert!(valid, "Signature should be valid!");
    println!();

    // ---------------------------------------------------------------
    // Step 4: Tamper test
    // ---------------------------------------------------------------
    let mut tampered_bytes = sig.as_bytes().to_vec();
    tampered_bytes[100] ^= 0x01;
    let tampered_sig = quantica::slh_dsa::Signature::<Shake128f>::from_bytes(&tampered_bytes).expect("from_bytes");

    let tampered_valid = SlhDsa::<Shake128f>::verify(message, b"", &tampered_sig, &pk).expect("verify call failed");

    println!("--- Tamper Test ---");
    println!("  flipped bit in sig[100]");
    println!("  valid:       {} (expected: false)", tampered_valid);
    assert!(!tampered_valid, "Tampered signature should be rejected!");
    println!();

    // ---------------------------------------------------------------
    // Summary: signature sizes across parameter sets
    // ---------------------------------------------------------------
    println!("--- SLH-DSA Signature Sizes (SHAKE-based) ---");
    println!(
        "  SHAKE-128f: sig={:>5} bytes, pk={:>2}, sk={:>3}",
        SlhDsa::<Shake128f>::signature_size(),
        SlhDsa::<Shake128f>::public_key_size(),
        SlhDsa::<Shake128f>::secret_key_size(),
    );
    println!(
        "  SHAKE-128s: sig={:>5} bytes, pk={:>2}, sk={:>3}",
        SlhDsa::<Shake128s>::signature_size(),
        SlhDsa::<Shake128s>::public_key_size(),
        SlhDsa::<Shake128s>::secret_key_size(),
    );
    println!(
        "  SHAKE-192f: sig={:>5} bytes, pk={:>2}, sk={:>3}",
        SlhDsa::<Shake192f>::signature_size(),
        SlhDsa::<Shake192f>::public_key_size(),
        SlhDsa::<Shake192f>::secret_key_size(),
    );
    println!(
        "  SHAKE-192s: sig={:>5} bytes, pk={:>2}, sk={:>3}",
        SlhDsa::<Shake192s>::signature_size(),
        SlhDsa::<Shake192s>::public_key_size(),
        SlhDsa::<Shake192s>::secret_key_size(),
    );
    println!(
        "  SHAKE-256f: sig={:>5} bytes, pk={:>2}, sk={:>3}",
        SlhDsa::<Shake256f>::signature_size(),
        SlhDsa::<Shake256f>::public_key_size(),
        SlhDsa::<Shake256f>::secret_key_size(),
    );
    println!(
        "  SHAKE-256s: sig={:>5} bytes, pk={:>2}, sk={:>3}",
        SlhDsa::<Shake256s>::signature_size(),
        SlhDsa::<Shake256s>::public_key_size(),
        SlhDsa::<Shake256s>::secret_key_size(),
    );
    println!();

    println!("All checks passed.");
}