Add SLH-DSA-SHA2-128s (FIPS 205) to aptos-crypto#18293
Merged
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
Contributor
Author
|
Note to self: Change SK (de)serialization to treat our SLH-DSA Importantly, re-derive the PK's This will ensure that we can recover an SLH-DSA |
alinush
changed the title
aptos-crypto
JoshLind
approved these changes
Dec 9, 2025
Contributor
JoshLind
left a comment
JoshLind
left a comment
There was a problem hiding this comment.
Looks reasonable to me (a non-cryptographer 😆)
| prettydiff = "0.6.2" | ||
| primitive-types = { version = "0.12.2" } | ||
| signature = "2.1.0" | ||
| slh-dsa = "0.2.0-rc.1" |
Contributor
There was a problem hiding this comment.
Always interesting to see -rc in a rust crate version 😄
rex1fernando
approved these changes
Dec 9, 2025
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Contributor
✅ Forge suite
|
This comment has been minimized.
This comment has been minimized.
Contributor
✅ Forge suite
|
zjma
approved these changes
Dec 10, 2025
This comment has been minimized.
This comment has been minimized.
Contributor
✅ Forge suite
|
waamm
reviewed
Dec 16, 2025
|
|
||
| /// The length in bytes of the SLH-DSA SHA2-128s PrivateKey: the SK seed, PRF seed and PK seed. | ||
| /// The PK seed is actually public, but must be stored in the SK, since it is picked randomly | ||
| /// and independently of all other SK material. |
Collaborator
There was a problem hiding this comment.
... and one wants the SK to be sufficient to regenerate the PK?
|
|
||
| /// Benchmarks the time to deserialize an SLH-DSA signature from a sequence of bytes. | ||
| fn sig_deserialize<M: Measurement>(g: &mut BenchmarkGroup<M>) { | ||
| let mut csprng = thread_rng(); |
Collaborator
There was a problem hiding this comment.
Maybe consider using a deterministic RNG for benchmarks?
Contributor
Author
There was a problem hiding this comment.
Yeah... I chose to test more cases over reproducibility here 🤷
It'd be nice to do both somehow: e.g., by automatically printing the seed during each test case so that it shows if it fails
| } | ||
| } | ||
|
|
||
| /// return an all-zero signature (for test only) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces
aptos-cryptotypes for the SLH-DSA signature scheme1 using the SHA2-128s parameterization.This lays a path forward towards post-quantum security for Aptos users.
Follow-up PRs
Benchmarks
Important
These are single-threaded benchmarks run on my Macbook Pro M1 Max.
On x86_64, the #'s may look different.
The scheme is sufficiently-fast to be used on Aptos:
Signature verification times are only 3-4x slower than Ed25519:
Signature sizes are 122.75x larger (7,856 bytes, instead of 64 bytes.)
Nonetheless: This loss in performance is very acceptable given that SLH-DSA is the most conservative post-quantum signature scheme in terms of cryptographic assumptions.
We can always add cheaper schemes that make extra cryptographic assumptions: e.g., ML-DSA in FIPS-2042 is the next natural choice; it only assumes MLWE.
How Has This Been Tested?
mod.rs)Key Areas to Review
This is just a wrapper around the
slh-dsacrate inRustCrypto/signatures.Not a lot of meaningful stuff to review, except:
RustCrypto/signaturesfor SLH-DSA?Type of Change
Which Components or Systems Does This Change Impact?
Checklist
Note
Adds SLH-DSA SHA2-128s to aptos-crypto, providing key/signature types with trait impls, serialization, tests, and benchmarks, plus dependency updates.
crates/aptos-crypto/src/slh_dsa_sha2_128s: addsPrivateKey,PublicKey,Signature, constants, and impls forSigningKey,VerifyingKey,Signature,Uniform,ValidCryptoMaterial.benches/slh_dsa_sha2_128s.rsmeasuring sign/verify and (de)serialization; wired via Cargo bench target.lib.rsand registers types intraits::private::Sealed.slh-dsa = "0.2.0-rc.1"; updates related crypto prereleases (digest,hmac,sha2,sha3,keccak,pkcs8,spki,signature, etc.) and bumpszeroize.bls12381_validatable.rs.Written by Cursor Bugbot for commit 919f6ed. This will update automatically on new commits. Configure here.
Footnotes
https://csrc.nist.gov/pubs/fips/205/final ↩
https://csrc.nist.gov/pubs/fips/204/final ↩