SLH-DSA: how many FORS private keys are there?

As an aside, let us consider how many FORS private keys there are.

Small example

Here is an example of a small tree from the SPHINCS+ paper and a diagram of one FTS node. The small tree has $h=9$ and $d=3$.

This small tree has $(2^{h/d})^d = (2^3)^3 = 2^9 = 512$ OTS nodes at the bottom HT layer, each able to sign a FORS tree (FTS node). Each FORS tree has $k\times t$ private key values, where $k$ and $t$ are parameters of the FORS tree.

So if, for example, we have $k=32$ binary hash trees and the height $a$ of the FORS tree is $a=4$ giving $t=2^a=16$, then we have $512 \times 32 \times 16 = 2^{18} = 262144$ private key values.

A real example

Expanding this to use the parameters for SLH-DSA-SHA2-128f, namely $h=66,\, d=22,\, k=33,\, a =6,\, t=2^a=2^6=64$, we have.

• The hypertree (HT) subtree size is $h/d = 66/22 = 3$
  • so each subtree has $2^3 = 8$ OTS nodes.
• We have $d=22$ subtrees
  • so we have $(2^3)^{22} = 2^{66}$ OTS nodes at the bottom HT layer
  • each signing a FORS tree (FTS node)
• Each FORS tree has $kt = 33 \cdot 2^6$ private key values
  • giving a total number of private key values $= 33\cdot 2^6 \cdot 2^{66} \approx 2^{77}$
  • this equals $1.56 \times 10^{23}$, about the number of stars in the Universe
• Remember each of these private keys can be computed deterministically using SK.seed and the ADRS parameter. We don't have to create them all each time, and we only need a (very) small subset when we create a signature.

Rate this page

Contact us

To comment on this page or to contact us, please send us a message.

This page first published 17 March 2023. Last updated 16 February 2026.