Core engineering and protocols for 50-Year Root CA Design.
While lattice-based algorithms like ML-DSA are fast and compact, their security rests on relatively modern mathematical assumptions (the hardness of M-LWE/M-SIS problems). If unexpected mathematical breakthroughs or new quantum algorithms weaken lattice cryptography in the future, all lattice-based root CAs would fall simultaneously. SLH-DSA provides the ultimate mathematical diversity hedge.
The primary engineering trade-off of SLH-DSA is signature size: an SLH-DSA signature ranges from 7,856 bytes to 49,856 bytes depending on security parameter sets. While unsuitable for high-frequency microservice RPCs, this size is completely negligible for root Certificate Authorities and trust anchors, where signatures are fetched infrequently and cached permanently.