slh-dsa

library0.2.3pypypi✓ verified 79d ago

Pure Python implementation of the SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) based on FIPS 205. Version 0.2.2 includes fixes for digest lengths and supports key import/export in PKCS format, signing, and verification. Actively maintained.

auth-security serialization

pip install slh-dsa

github ↗package ↗

INSTALL

IMPORT

SIG · SLH-DSA

slh-dsa

auth-securitypythonv0.2.3

Install

1.7s avg

Import

—

Disk

18MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.2.3 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 19.8MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.7s · import 0.000s · 21MB

18MB installed

● package 18MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SLHDSA

✓ from slhdsa import SLHDSAException

✗ from slh_dsa import SLHDSA

KeyPair

✓ from slhdsa import KeyPair

PublicKey

✓ from slhdsa import PublicKey

Generate SLH-DSA keys, sign, and verify.

from slh_dsa import SLHDSA # Generate a private key (SLH-DSA with SHAKE-128, security level 1) private_key = SLHDSA.new('shake_128') message = b"Hello, world!" signature = private_key.sign(message) # Extract public key (serialized PKCS format) public_key_pem = private_key.public_key().export_pkcs() # Verify signature from slh_dsa import verify verify(public_key_pem, message, signature) # Returns True/False

Debug

Known issues

gotchaThe library uses 'shake_128', 'shake_256', 'sha2_192', 'sha2_256' as algorithm identifiers. Ensure you use the exact string matching the intended security level.

fix

Use one of: 'shake_128', 'shake_256', 'sha2_192', 'sha2_256'. Check FIPS 205 for parameter sets.

affects: >=0.1.0

gotchaSigning with a private key does not return a serializable format; you must export the key via `export_pkcs()` before sending or storage. The private key object is not directly serializable.

fix

Use `private_key.export_pkcs()` to get a bytes representation, and `SLHDSA.import_pkcs(data)` to reload.

affects: >=0.2.1

breakingVersion 0.2.0 introduced mypyc compilation, which may cause import failures on some platforms (e.g., Alpine Linux, ARM32). The package may not be precompiled for all architectures.

fix

If import fails with 'ModuleNotFoundError' or 'ImportError: cannot import name', consider installing from source with `pip install slh-dsa --no-binary slh-dsa`.

affects: 0.2.0+

Upgrade

Version history

0.2.3latest on PyPI · released Jun 6, 2026

Audit

Dependencies

No dependency data recorded yet.

Agent activity

33 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/colinxu2020/slhdsa ↗

packagehttps://pypi.org/project/slh-dsa/ ↗