The ADRS parameter in SLH-DSA and hash functions

Some hash functions in SLH-DSA take a 32-byte address (ADRS) value as input. A different ADRS value is used for each call to each function.

For the SHA2 family, the address is compressed to a 22-byte value, denoted ADRS_c.

Structure

The structure of an ADRS is

+-----------------+
| layer address   |  4 bytes
+-----------------+
|                 |
| tree address    |  12 bytes
|                 |
+-----------------+
| type            |  4 bytes
+-----------------+
| word1           |  4 bytes
+-----------------+
| word2           |  4 bytes
+-----------------+
| word2           |  4 bytes
+-----------------+

The values are encoded as unsigned integers in big-endian byte order.

The layer address is the height within the hypertree. Trees at the bottom have a height of zero and the tree at the top has a height of $d-1$. The tree address is the position of the tree within a layer of the hypertree, starting at zero on the left, and extending up to a large value^[1] in the order of $2^{63}$ on the right for the bottom tree.

[1] The maximum value of tree address at height zero is $2^{h - h/d} - 1$.

There are 7 ADRS types:

WOTS_HASH  = 0
WOTS_PK    = 1
TREE       = 2
FORS_TREE  = 3
FORS_ROOTS = 4
WOTS_PRF   = 5
FORS_PRF   = 6

The values of the last 3 words word1, word2, word3 in ADRS depend on the type, as follows:

--------------------------------------------------------------------------
Type                    word1        word2      word3       Type constant      
-------------------------------------------------------------------------                 
0 WOTS+ hash addr       keypairaddr  chainaddr  hashaddr    WOTS_HASH
1 WOTS+ pub key compr   keypairaddr  0          0           WOTS_PK
2 Hash tree addr        0            tree_ht    tree_index  TREE
3 FORS tree addr        keypairaddr  tree_ht    tree_index  FORS_TREE  
4 FORS tree roots compr keypairaddr  0          0           FORS_ROOTS
5 WOTS+ key generation  keypairaddr  chainaddr  0           WOTS_PRF
6 FORS key generation   keypairaddr  0          tree_index  FORS_PRF

Compression of ADRS for SHA-2

A compressed address (ADRS_c) is a 22-byte string that is the same as an ADRS with the exceptions that the encodings of the layer address and type are reduced to one byte each and the encoding of the tree address is reduced to eight bytes.

+----+
|    | layer address 1 byte
+----+------------+
| tree address    |  8 bytes
|                 |
+----+------------+
|    |  type         1 byte
+----+------------+
+ word1           +  4 bytes
+-----------------+
+ word2           +  4 bytes
+-----------------+
+ word2           +  4 bytes
+-----------------+

Example

32-byte ADRS

layer[4] treeaddr[12]             type[4]  word1[4] word2[4] word3[4]
00000000 00000000006894ec35fadda8 00000003 0000000d 00000000 00000ca2

This is a type 3 address (FORS_TREE), where word1 (0xd) represents the keypair address, word2 (0x0) is the tree height, and word3 (0xca2) is the tree index.

Compressed to 22-byte ADRS_c

layer   treeaddr  type    word1    word2    word3
[1]          [8]   [1]      [4]      [4]      [4]
00 006894ec35fadda8 03 0000000d 00000000 00000ca2

Hash functions

There are 6 hash functions used in SHL-DSA.

• PRF_msg (SK.prf, opt_rand, M)
• H_msg (R, PK.seed, PK.root, M)
• PRF (PK.seed, SK.seed, ADRS)
• T_len (PK.seed, ADRS, M)
• H (PK.seed, ADRS, M)
• F (PK.seed, ADRS, M)

These functions are instantiated differently depending on the hash family. For the SHAKE family, they use SHAKE256. For the SHA2 family, they use either SHA-256 or SHA-512 and their corresponding MGF1 and HMAC functions.

For more details see sections 11.1 and 11.2 of FIPS.205

Contact us

To comment on this page or to contact us, please send us a message.

This page first published 29 December 2025. Last updated 29 December 2025.