Standardised instance: | |||

n | |||

h | |||

d | |||

w | |||

Maximum number of signatures | |||

Signatures size^{3} |
|||

Hashes^{1} in keygen |
|||

Hashes^{1} in signature generation
without caching | |||

Hashes^{1,2} in verification |
|||

OTS Chains |

- This is a rough approximation: not every hash is counted.
Furthermore, there can be considerable overhead in moving
data around.
If the
*generic*hash is selected, this counts hash calls. If a specific hash is selected, then the number of internal blocks/permutations is counted. Assumes for XMSS that the state after digesting the public seed is precomputed. - Assumes the worst case that signatures are all zeroes. In the average case fewer hash calls will be required.
- Will be slightly larger for an actual scheme: does not include the signature sequence number, algorithm specification and digest randomization value.
- We take
**w**to be the length of the chains as in XMSS^{MT}and SPHINCS^{+}. What is called**w**in LMS/HSS corresponds to 2^{w}. - In LMS/HSS the size of the hashes in the OTS, called
**n**can be different from the size of the hashes in the Merkle tree denoted by**m**. We assume*n*=*m*.