35 |
a 110 KB signature, 201'952 hash function invocations for signing, and |
a 110 KB signature, 201'952 hash function invocations for signing, and |
36 |
5'568 hash invocations for verification. |
5'568 hash invocations for verification. |
37 |
On a more practical level, we discuss a |
On a more practical level, we discuss a |
38 |
probabilistically valid instance with 56-bit security |
probabilistically valid instance |
39 |
if only used for up to XXX signatures. |
which can be used for any number of signatures |
40 |
|
within the bounds of the 56-bit birthday paradox. |
41 |
The probabilistic scheme requires |
The probabilistic scheme requires |
42 |
a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes |
a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes |
43 |
for verification. |
for verification. |