### TABLE IV SUMMARY OF DIGITAL SIGNATURE COSTS. MESSAGE HASH SIZE s = 160.

2005

Cited by 4

### Table 1: Shortened and E#0Ecient Digital Signature Schemes

1998

"... In PAGE 7: ...x mod p from r, s, g, p and y a and then check whether hash#28k;m#29 is identical to r. Table1 shows two shortened versions of DSS, which are denoted by SDSS1 and SDSS2 respectively. Here are a few remarks on the table: 1.... In PAGE 36: ...3.2.2 Comparison with Beller-Yacobi Protocol The next protocol we examine is an e#0Ecient proposal by Beller and Yacobi #5B6#5D. Their proto- col is brie#0Dy summarized in Table1 0, using notations consistent with those for signcryption schemes. As is the case for our proposals based on signcryption, here it is assumed too that public key certi#0Ccates have already been transferred prior to an execution of the protocol.... In PAGE 37: ...Bob K 2 R f0; 1g ` k c 1 = K 3 mod n B #29 c 1 #29 Extract K from c 1 by using the decryption key associated with the RSA composite n B Decrypt c 2 and verify the format of the message #28 c 2 #28 Choose a random m c 2 = E K #28m; 0 t #29 Compute ElGamal signature #28v;w#29on#28m; etc#29 c 3 = E K #28v; w; etc#29 #29 c 3 #29 Decrypt c 3 and verify #28v;w#29 Table1 0: Beller-Yacobi Authenticated Key Transport Protocol Protocols Comp. Cost #23 of exp.... In PAGE 37: ... + Only when Alice knows whom to communicate with. Table1 1: Comparison with Beller-Yacobi Protocol... In PAGE 46: ... These signcryption schemes are called ECSCS1 and ECSCS2 respectively. Similarly to elliptic curve signature schemes described in Table1 2, points on an elliptic curve, namely vP a , uP a + urG and uG + urP a , are regarded as binary strings when involved in hashing. The bind info part in the computation of r contains, among other data items, identi#0Ccation information of Bob the recipient such as his public key or public key certi#0Ccate.... In PAGE 47: ... P a : Alice apos;s public key #28P a = v a G, a pointonC#29. Table1 2: Elliptic Curve DSS and Its Shortened and E#0EcientVariants Parameters public to all: C | an elliptic curveover GF #28p m #29, either with p #3E = 2 150 and m =1 or p = 2 and m #3E = 150 #28public to all#29. q | a large prime whose size is approximately of jp m j #28public to all#29.... In PAGE 47: ... P b | Bob apos;s public key #28P b = v b G, a pointonC#29. Table1 3: Parameters for Elliptic Curve Signcryption... In PAGE 48: ... #29 c; r;s #29 u=sv b mod q #28k 1 ;k 2 #29=hash#28uP a + urG#29 if SECDSS1 is used, or #28k 1 ;k 2 #29=hash#28uG + urP a #29 if SECDSS2 is used. m = D k 1 #28c#29 Accept m only if KH k 2 #28m; bind info#29=r Table1 4: Implementations of Signcryption on Elliptic Curves We note that the #5Csquare-and-multiply quot; method for fast exponentiation can be adapted to a #5Cdoubling-and-addition quot; method for the fast computation of a multiple of a pointon an elliptic curve. Namely a multiple can be obtained in about 1:5jqj point additions.... ..."

### Table 1. Comparison of aggregate signature schemes. Signatures are by l signers; k is the output length of a collision resistant hash function; R.O. denotes if the security proof uses random oracles.

2006

"... In PAGE 14: ... The other uses ordinary RSA keys and can have pub- lic exponent e = 3 for fast verification, but requires key certification, like our scheme; we call this variant LMRS-2. We present the comparisons in Table1 . The size column gives signature length at the 1024-bit security level.... ..."

Cited by 11

### Table 1. Comparison of aggregate signature schemes. Signatures are by l signers; k is the output length of a collision resistant hash function; R.O. denotes if the security proof uses random oracles.

2006

"... In PAGE 14: ... The other uses ordinary RSA keys and can have pub- lic exponent e = 3 for fast verification, but requires key certification, like our scheme; we call this variant LMRS-2. We present the comparisons in Table1 . The size column gives signature length at the 1024-bit security level.... ..."

Cited by 11

### Table 3: Digital Signature Timings

1998

Cited by 1

### Table 3: Digital Signature Timings

1998

Cited by 1