Suppose a 256 bit hash is used (SHA2, SHA3, ...). How does the Winternitz OTS perform at various signature sizes?
I'd want to compare to a generalized K-teeth Haircomb:
- It's signature is $K$ of these 256-bit hashes
- the public key is one hash.
- We are signing a 256-bit message digest as well
- the chain length is approximated¹ (per Whitepaper) by: $$X\approx2^{256/(K-1)}\times{(K-1)!}^{1/(K-1)}-K/2$$
- Key Generation performs $X\times K+1$ hashes
- Signing invocations perform $X\times(K-1)$ hashes
- Verification invocations perform $X+1$ hashes.
Question: What are the equivalent Hash invocation counts for Winternitz OTS, as used by the SPHINCS+ standard for instance?
Note that I'm specifically asking for the number of hash invocations used for signing, verifying and key generation.
¹ $X$ (for one chain) is approximated as in this table (rounded numbers, inexact).