Appendix B. Security Strengths

This section preserves the RFC text for X.509 SLH-DSA algorithm identifiers, including ASN.1, OIDs, AlgorithmIdentifier, id-slh-dsa-* and id-hash-slh-dsa-* names, DER examples, certificates, key usage, IANA registrations, and security requirements.

Original RFC Text

Appendix B.  Security Strengths

   Instead of defining the strength of a quantum algorithm using the
   number of bits of security, NIST defined a collection of broad
   security strength categories.  Each category is defined by a
   comparatively easy-to-analyze reference primitive that covers a range
   of security strengths offered by existing NIST standards in symmetric
   cryptography, which NIST expects to offer significant resistance to
   quantum cryptanalysis.  These categories describe any attack that
   breaks the relevant security definition that must require
   computational resources comparable to or greater than those required
   for:

   *  Level 1 - key search on a block cipher with a 128-bit key (e.g.,
      AES128),

   *  Level 2 - collision search on a 256-bit hash function (e.g.,
      SHA256/ SHA3-256),

   *  Level 3 - key search on a block cipher with a 192-bit key (e.g.,
      AES192),

   *  Level 4 - collision search on a 384-bit hash function (e.g.,
      SHA384/SHA3-384), and

   *  Level 5 - key search on a block cipher with a 256-bit key (e.g.,
      AES 256).

   The SLH-DSA parameter sets defined for NIST security levels 1, 3, and
   5 are listed in Table 1, along with the resulting signature, public
   key, and private key sizes in bytes.  The HashSLH-DSA parameter sets
   have the same values as the Pure SLH-DSA equivalents.

   +==============================+============+======================+
   | OID                          | NIST Level |   Size (in bytes)    |
   |                              |            +=======+======+=======+
   |                              |            | Sig.  | Pub. | Priv. |
   |                              |            |       | Key  | Key   |
   +==============================+============+=======+======+=======+
   | id-(hash-)slh-dsa-sha2-128s  | 1          | 7856  | 32   | 64    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-sha2-128f  | 1          | 17088 | 32   | 64    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-sha2-192s  | 3          | 16224 | 48   | 96    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-sha2-192f  | 3          | 35664 | 48   | 96    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-sha2-256s  | 5          | 29792 | 64   | 128   |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-sha2-256f  | 5          | 49856 | 64   | 128   |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-shake-128s | 1          | 7856  | 32   | 64    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-shake-128f | 1          | 17088 | 32   | 64    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-shake-192s | 3          | 16224 | 48   | 96    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-shake-192f | 3          | 35664 | 48   | 96    |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-shake-256s | 5          | 29792 | 64   | 128   |
   +------------------------------+------------+-------+------+-------+
   | id-(hash-)slh-dsa-shake-256f | 5          | 49856 | 64   | 128   |
   +------------------------------+------------+-------+------+-------+

                   Table 1: SLH-DSA Security Strengths