Standardised instance:	(custom)
n	Security parameter5
h	Height of tree
d	Number of subtrees
	Height of subtrees
w	Winternitz parameter4
	Variant & hash	Generic XMSSMT LMS/HSS	Generic SHA256 SHA512 SHAKE128 SHAKE256
Maximum number of signatures
Signatures size3
Hashes1 in keygen
Hashes1 in signature generation without caching
Hashes1,2 in verification
OTS Chains

1. This is a rough approximation: not every hash is counted. Furthermore, there can be considerable overhead in moving data around. If the generic hash is selected, this counts hash calls. If a specific hash is selected, then the number of internal blocks/permutations is counted. Assumes for XMSS that the state after digesting the public seed is precomputed.
2. Assumes the worst case that signatures are all zeroes. In the average case fewer hash calls will be required.
3. Will be slightly larger for an actual scheme: does not include the signature sequence number, algorithm specification and digest randomization value.
4. We take w to be the length of the chains as in XMSS^MT and SPHINCS⁺. What is called w in LMS/HSS corresponds to 2^w.
5. In LMS/HSS the size of the hashes in the OTS, called n can be different from the size of the hashes in the Merkle tree denoted by m. We assume n=m.