Track the progress of the 'small parameter sets' discussion for SLH-DSA

[athoelke]

NIST is exploring the possibilty of standardising additional parameter sets for SLH-DSA, that permit fewer signatures before the security strength is weakened, but trade that with signature size, signature time and verify time.

Specific use cases (such as IoT device firmware signing) could benefit from such a parameter-set:

• The implementation of SLH-DSA is much simpler/smaller than the ML-DSA equivalent.
• The management of the signing key(s) is much simpler than with stateful hash-based LMS or XMSS signatures.

The discussion thread on the pqforum mailing list is here.