Standardised instance:
Maximum number of signatures
Signatures size3
Hashes1 in keygen
Hashes1 in signature generation without caching
Hashes1,2 in verification
OTS Chains
  1. This is a rough approximation: not every hash is counted. Furthermore, there can be considerable overhead in moving data around. If the generic hash is selected, this counts hash calls. If a specific hash is selected, then the number of internal blocks/permutations is counted. Assumes for XMSS that the state after digesting the public seed is precomputed.
  2. Assumes the worst case that signatures are all zeroes. In the average case fewer hash calls will be required.
  3. Will be slightly larger for an actual scheme: does not include the signature sequence number, algorithm specification and digest randomization value.
  4. We take w to be the length of the chains as in XMSSMT and SPHINCS+. What is called w in LMS/HSS corresponds to 2w.
  5. In LMS/HSS the size of the hashes in the OTS, called n can be different from the size of the hashes in the Merkle tree denoted by m. We assume n=m.