It combines a hypertree of Merkle-tree one-time-signature layers (WOTS+) with the few-time scheme FORS. Twelve parameter sets cover SHA-2 and SHAKE at categories 1, 3 and 5, each in a small (s) and fast (f) variant; public keys are 32, 48 or 64 bytes and signatures range from 7,856 bytes (128s) to 49,856 bytes (256f). Each key may sign up to 2⁶⁴ messages, and no state needs to be kept, unlike LMS and XMSS.
Speed on one Apple M4 Max core with OpenSSL 3.6.5: SLH-DSA-SHA2-128s signs about 7 messages per second (about 137 ms each) and verifies about 7,400; the 128f variant signs about 144 per second with 17,088-byte signatures. That suits roots of trust, firmware and long-lived documents rather than per-connection signing.
SLH-DSA is the conservative hedge against an unexpected break of lattice assumptions. X.509 identifiers come from RFC 9909 (id-slh-dsa-sha2-128s, 2.16.840.1.101.3.4.3.20 and following), and RFC 9980 brings SLH-DSA-SHAKE variants to OpenPGP.