### Table 8: Merkle Signature Scheme

2004

"... In PAGE 23: ...Table8 on page 21 shows the efficiency of the Merkle key generation, the Merkle signature gen- eration, and the Merkle signature verification. That table shows that the efficiency of the Merkle signature scheme is competitive.... ..."

### Table 8: Merkle Signature Scheme

2004

"... In PAGE 23: ...Table8 on page 21 shows the efficiency of the Merkle key generation, the Merkle signature gen- eration, and the Merkle signature verification. That table shows that the efficiency of the Merkle signature scheme is competitive.... ..."

### Table 20: Signing key, veri cation key, and signature sizes (bytes) of di erent signature schemes.

"... In PAGE 21: ...Table 20: Signing key, veri cation key, and signature sizes (bytes) of di erent signature schemes. Table20 shows the signing/veri cation key and signature sizes. The signing keys are from 96 to 384 bytes in all schemes except eFFS whose signing keys are much larger, from 3,120 to 16,512 bytes.... ..."

### Table 7: Signing key, veri cation key, and signature sizes (bytes) of di erent signature schemes.

"... In PAGE 19: ...) 4.1 Key and signature sizes Table7 shows the signing/veri cation key and signature sizes. The signing keys are from 96 to 384 bytes in all schemes except eFFS whose signing keys are much larger, from 6,192 to 16,512 bytes.... ..."

### Table 2: Examples of signatures 1

"... In PAGE 11: ... The requirement there is that Dom ( ;n;f) should have at most one element. Obviously, such a requirement is overly strong for order-sorted signatures and is not complied by the order-sorted signatures of natural numbers and Harrop formulae in Table2 . Those examples suggest that it is in fact more appropriate to de ne a notion of canonical declaration.... In PAGE 12: ... Strict overloading isolates a class of order-sorted signatures for which non- determinism is innocuous. Indeed, all strictly overloaded order-sorted signa- tures, including those of Table2 , support recursive de nitions as they can be simulated by strictly overloaded many-sorted signatures. As alluded above, the idea is to restrict ourselves to canonical declarations: formally, this provides a method to build a many-sorted signature from an order-sorted one and is the key to the the theory of recursive de nitions.... In PAGE 14: ...4.3 Examples Lists This is the parametric signature de ned in Table2 . Assume I 2 P ! Set and J 2 ! Set.... ..."

### Table 12. Signing and verifying times (ms) of different signature schemes.

"... In PAGE 11: ...2. Signing and verification times Table12 shows the signing and verification times for a 16-byte message (digest).14 DSA and ElGamal have been designed to achieve efficient signing (e.... In PAGE 11: ...esigned to achieve efficient signing (e.g., for use in smart- card applications), and RSA and Rabin have been designed to achieve efficient verification. From Table12 , note that the signing operations of DSA and ElGamal, with times 13Such signing keys are indeed too large for small devices, such as smartcards, but it is unlikely that these devices would generate flows. 14We use e=3 in RSA to obtain its fastest verification time without af- fecting its signing time.... ..."

### Table 12. Signing and verifying times (ms) of different signature schemes.

"... In PAGE 11: ...2. Signing and verification times Table12 shows the signing and verification times for a 16-byte message (digest).14 DSA and ElGamal have been designed to achieve efficient signing (e.... In PAGE 11: ...esigned to achieve efficient signing (e.g., for use in smart- card applications), and RSA and Rabin have been designed to achieve efficient verification. From Table12 , note that the signing operations of DSA and ElGamal, with times 13Such signing keys are indeed too large for small devices, such as smartcards, but it is unlikely that these devices would generate flows. 14We use e=3 in RSA to obtain its fastest verification time without af- fecting its signing time.... ..."

### Table 4 shows our measurements for signature generation with plain RSA, DSA and Schnorr schemes which are form basis of TS- RSA, TS-DSA, and ASM, respectively. Table 5 shows the cost of signature generation in terms of key size, where t=3. In TS-RSA, the cost in generating a partial signature is almost the same as that of RSA signature generation, but we need extra cost to compute a0

"... In PAGE 6: ... As evident from the table, ASM is the best performer. Table4 : Signature Generation Costs of Basic Schemes in msecs (P3-977MHz) Key RSA DSA Schnorr 512 1.390 1.... In PAGE 8: ... In TS-RSA, verification of the threshold signature is ex- tremely high, due to the a0 -bounded offsetting algorithm mentioned earlier. The costs of signature generation and verification in DSA and Schnorr (on which TS-DSA and ASM are based) as listed in Table4 and Table 6 are comparable, however, ASM becomes more efficient than TS-DSA because of fewer rounds. For the dynamic threshold case, TS-RSA is slightly ahead of TS-DSA because, in the latter, a considerable amount of time is spent on updating the polynomials as a consequence of the changing threshold.... ..."

### Table 4 shows our measurements for signature generation with plain RSA, DSA and Schnorr schemes which are form basis of TS- RSA, TS-DSA, and ASM, respectively. Table 5 shows the cost of signature generation in terms of key size, where t=3. In TS-RSA, the cost in generating a partial signature is almost the same as that of RSA signature generation, but we need extra cost to compute a0

"... In PAGE 6: ... As evident from the table, ASM is the best performer. Table4 : Signature Generation Costs of Basic Schemes in msecs (P3-977MHz) Key RSA DSA Schnorr 512 1.390 1.... In PAGE 8: ... In TS-RSA, verification of the threshold signature is ex- tremely high, due to the a0 -bounded offsetting algorithm mentioned earlier. The costs of signature generation and verification in DSA and Schnorr (on which TS-DSA and ASM are based) as listed in Table4 and Table 6 are comparable, however, ASM becomes more efficient than TS-DSA because of fewer rounds. For the dynamic threshold case, TS-RSA is slightly ahead of TS-DSA because, in the latter, a considerable amount of time is spent on updating the polynomials as a consequence of the changing threshold.... ..."

### Table 2: Efficiency of AOS with signature aggregation. Data is given for messages of length n.

in Contents

2005

"... In PAGE 9: ... To be more precise, the length of an AOS signature of a message of length n can be condensed to one signature of ASGN , n public keys of ASGN , and one secret key of ASGN . We summarize the efficiency of this approach in Table2 . We note that there are two known signature aggregation techniques.... ..."